Finally: German Whistleblower Protection Act soon to come into force

When does a whistleblower system have to be implemented?

Ac­cor­ding to EU law, Di­rec­tive (EU) 2019/1937 ("Whist­leb­lo­wer Di­rec­tive") should have been trans­po­sed into Ger­man law by 17 De­cem­ber 2021.The de­layed im­ple­men­ta­tion could lead in part to the di­rect ap­pli­ca­tion of the EU Di­rec­tive, par­ti­cu­larly for com­pa­nies from the pu­blic sec­tor.

© iStock

Pri­vate com­pa­nies in Ger­many, have been able to wait for the trans­po­si­tion of the di­rec­tive into Ger­man law - but now there is an ur­gent need for ac­tion! The ob­li­ga­tion to in­tro­duce a cor­re­spon­ding whist­leb­lo­wer sys­tem exists for com­pa­nies in Ger­many with more than 249 em­ployees shall ap­ply from 02.07.2023.

Only com­pa­nies in Ger­many with 50 to 249 em­ployees will not have to im­ple­ment a cor­re­spon­ding whist­leb­lo­wing sys­tem un­til 17 De­cem­ber 2023.

Which companies in Germany are affected?

The ob­li­ga­tion to im­ple­ment a no­ti­fi­ca­tion sys­tem ap­plies in prin­ci­ple to all pri­vate and pu­blic com­pa­nies in Ger­many with at least 50 em­ployees as a rule. For cer­tain com­pa­nies the ob­li­ga­tion is ar­ran­ged ir­re­spec­tive of their num­ber of em­ployees. In prin­ci­ple, only me­dium-si­zed com­pa­nies with a work­force of 50 to 249 em­ployees are sub­ject to sim­pli­fied re­gu­la­ti­ons. These com­pa­nies may es­ta­blish and ope­rate a joint of­fice for the col­lec­tion of no­ti­fi­ca­ti­ons and for the other mea­su­res re­qui­red by the Act. Howe­ver, they re­main ob­li­ged to re­port the vio­la­tion and to pro­vide feed­back to the whist­leb­lo­wer. For af­fi­lia­ted com­pa­nies, a sim­pli­fi­ca­tion is pro­vi­ded to the ex­tent that an in­de­pen­dent and trust­wor­thy body can also be es­ta­blis­hed as a "third party" in the case of an af­fi­lia­ted com­pany, which can also work for se­veral in­de­pen­dent com­pa­nies in the group. In­ter­nal re­por­tings must then also be pos­si­ble in the working lan­guage of the re­spec­tive com­mis­sio­ning sub­si­di­ary. The com­mis­sio­ning of a cen­tral re­por­ting of­fice at a group com­pany must not create any ad­di­tio­nal hurd­les for per­sons pro­vi­ding in­for­ma­tion.

What types of whistleblowing systems are allowed?

In prin­ci­ple, there are two equally im­port­ant re­por­ting chan­nels avail­able to whist­leb­lo­wers. These are, on the one hand, in­ter­nal and, on the other hand, ex­ter­nal re­por­ting chan­nels. Howe­ver, the whist­leb­lo­wer should pre­fer to re­port to an in­ter­nal re­por­ting of­fice in ca­ses where ef­fec­tive in­ter­nal ac­tion can be ta­ken against the vio­la­tion and the whist­leb­lo­wer does not fear re­pri­sals.

Internal reporting channels

There is mar­gin for the pre­cise de­sign of the in­ter­nal re­por­ting chan­nel. The in­ter­nal re­por­ting of­fice can be set up by ent­rus­ting the tasks of the in­ter­nal re­por­ting of­fice to a per­son em­ployed by the re­spec­tive em­ployer, a work unit con­sis­ting of se­veral em­ployed per­sons or a third party. In par­ti­cu­lar, a la­wyer can also be ent­rus­ted with the tasks of the in­ter­nal re­por­ting of­fice as an ex­ter­nal om­buds­per­son. In each case, the per­son in charge re­qui­res suf­fi­ci­ent com­pe­tence to be able to carry out the ne­cessary le­gal as­sess­ment of the re­ports.

The tasks of the in­ter­nal re­por­ting of­fice in­clude the ope­ra­tion of the re­por­ting chan­nels, the im­ple­men­ta­tion of the pro­ce­dure and the pre­pa­ra­tion of ap­pro­priate fol­low-up mea­su­res.

The re­por­ting chan­nels must al­low mes­sa­ges in writ­ten or oral form.

An ob­li­ga­tion to set up re­por­ting of­fices that also al­low an­ony­mous re­por­ting, as in­iti­ally sug­gested no lon­ger exists un­der the law that has now been pas­sed. The law "me­rely" pro­vi­des that the in­ter­nal re­por­ting of­fice should also pro­cess an­ony­mous re­ports. Howe­ver, com­pa­nies are free to enable an­ony­mous con­tact and an­ony­mous com­mu­ni­ca­tion bet­ween the per­son sub­mit­ting the re­port and the in­ter­nal re­por­ting of­fice. This also ap­plies in par­ti­cu­lar to those, who have al­re­ady set up such chan­nels.

If a whist­leb­lo­wer re­port is re­cei­ved by the com­pany, the con­fi­den­tia­lity of the iden­tity of the whist­leb­lo­wer, the per­sons who are the sub­ject of the re­port and other per­sons na­med in the re­port must be en­su­red. Ex­cep­ti­ons to this ob­li­ga­tion of con­fi­den­tia­lity are only per­mit­ted in very nar­rowly de­fi­ned ca­ses.

Against the back­drop of the le­gal re­qui­re­ments, the most sui­ta­ble whist­leb­lo­wing sys­tem is an elec­tro­nic re­por­ting sys­tem. In ad­di­tion, a phy­si­cal mee­ting wi­thin an ap­pro­priate time frame must be made pos­si­ble at the re­quest of the per­son gi­ving the notice. The pos­si­bi­lity for per­sons pro­vi­ding in­for­ma­tion to have a per­so­nal con­ver­sa­tion is par­ti­cu­larly im­port­ant when a third party is ent­rus­ted with the tasks of an in­ter­nal re­por­ting of­fice. Howe­ver, with the cons­ent of the per­son gi­ving the in­for­ma­tion, the mee­ting can also be pro­vi­ded by way of vi­deo and au­dio trans­mis­sion.

The in­ter­nal no­ti­fi­ca­tion chan­nel must at least be avail­able to the em­ployees and loaned workers of the com­pany. The re­por­ting sys­tem may also be made ac­ces­si­ble volun­ta­rily to those per­sons who are in con­tact with the re­spec­tive com­pany in the course of their oc­cupa­tio­nal ac­tivity. These are, for ex­am­ple, mem­bers of the com­pany's exe­cu­tive bo­dies and share­hol­ders, em­ployees, self-em­ployed per­sons or for­mer em­ployees.

External reporting channels

In ad­di­tion to main­tai­ning an in­ter­nal re­por­ting sys­tem, com­pa­nies must also pro­vide their em­ployees with com­pre­hen­si­ble and ea­sily ac­ces­si­ble in­for­ma­tion on the pos­si­bi­li­ties of ma­king ex­ter­nal re­ports to cer­tain aut­ho­ri­ties. It also ap­plies to these ex­ter­nal re­por­ting of­fices that they should pro­cess an­ony­mous re­ports, but do not have to set up a cor­re­spon­ding chan­nel for this pur­pose. At the same time it is sti­pu­la­ted that it is the task of the ex­ter­nal re­por­ting of­fices to pro­vide in­for­ma­tion about the pos­si­bi­lity of in­ter­nal re­por­ting.

In prin­ci­ple, the whist­leb­lo­wer can de­cide whe­ther to re­port vio­la­ti­ons in­ter­nally or ex­ter­nally to an aut­ho­rity. Howe­ver, as de­scri­bed above, in­ter­nal re­por­ting bo­dies are to be gi­ven pre­fe­rence. Em­ploy­ers should con­ti­nue to create in­cen­ti­ves for whist­leb­lo­wers to first con­tact the re­spec­tive in­ter­nal re­por­ting of­fice be­fore re­por­ting to an ex­ter­nal re­por­ting of­fice and pro­vide clear and ea­sily ac­ces­si­ble in­for­ma­tion for em­ployees on the use of the in­ter­nal re­por­ting pro­ce­dure. At the same time, they are ob­li­ged to pro­vide in­for­ma­tion on ex­ter­nal re­por­ting pro­ce­du­res.

Which reports enjoy whistleblower protection?

The Whist­leb­lo­wer Pro­tec­tion Act goes beyond the pro­vi­si­ons of the EU Di­rec­tive in its scope of ap­pli­ca­tion. Ac­cor­din­gly, whist­leb­lo­wers are pro­tec­ted when re­por­ting vio­la­ti­ons that are pu­nis­hable by cri­mi­nal law or (with cer­tain re­stric­tions) pu­nis­hable by a fine (Ad­mi­nis­tra­tive Of­fen­ses Act). The re­port must con­tain in­for­ma­tion on vio­la­ti­ons at the em­ployer where the whist­leb­lo­wer is or was em­ployed or at ano­ther of­fice with which the whist­leb­lo­wer is or was in con­tact due to his or her pro­fes­sio­nal ac­tivity.

In ad­di­tion, the ma­te­rial scope of ap­pli­ca­tion ex­tends to other vio­la­ti­ons of le­gal re­gu­la­ti­ons of the Fe­deral Go­vern­ment and the Fe­deral Sta­tes as well as di­rectly ap­plica­ble le­gal acts of the EU and the Eu­ro­pean Ato­mic En­ergy Com­mu­nity le. This in­clu­des the fol­lo­wing areas in par­ti­cu­lar:

• fight against mo­ney laun­de­ring and ter­ro­rism,
• pro­duct safety and con­for­mity,
• trans­port se­cu­rity, in­clu­ding rail­way se­cu­rity, ma­ri­time trans­port and air trans­port se­cu­rity,
• en­viron­men­tal pro­tec­tion,
• ra­dia­tion pro­tec­tion and nu­clear safety,
• food and feed safety, ani­mal health and ani­mal wel­fare,
• pu­blic health,
• con­su­mer pro­tec­tion,
• pri­vacy and per­so­nal data pro­tec­tion and se­cu­rity of net­work and in­for­ma­tion sys­tems,
• cer­tain vio­la­ti­ons of the Act on Re­stric­tions of Com­pe­ti­tion.

Whistleblower reporting - and then?

The whist­leb­lo­wer must re­ceive con­fir­ma­tion of re­ce­ipt of the re­port wi­thin se­ven days by the in­ter­nal re­por­ting of­fice. The re­cei­ved re­port is then che­cked by the in­ter­nal re­por­ting of­fice. Sub­se­quently, ap­pro­priate fol­low-up mea­su­res must be ta­ken. For ex­am­ple, the pro­ce­dure can also be re­fer­red to a working unit re­spon­si­ble for in­ter­nal in­ves­ti­ga­ti­ons at the com­pany for the pur­pose of fur­ther in­ves­ti­ga­ti­ons. In ad­di­tion, the ex­plana­ti­ons cla­rify that in or­der to carry out in­ter­nal in­ves­ti­ga­ti­ons - un­der the con­di­tion of con­fi­den­tia­lity - in­for­ma­tion can also be pas­sed on to work units at the com­pany.

The in­ter­nal re­por­ting of­fice must send a re­sponse to the per­son ma­king the re­port wi­thin th­ree months of con­fir­ming re­ce­ipt of the re­port. The feed­back shall in­clude the no­ti­fi­ca­tion of plan­ned and al­re­ady ta­ken fol­low-up mea­su­res as well as the re­asons for these.

The in­com­ing no­ti­fi­ca­ti­ons must be do­cu­men­ted. If ne­cessary, the do­cu­men­ta­tion should be pre­sen­ted to the whist­leb­lo­wer for ve­ri­fi­ca­tion pur­po­ses.

The law does not spe­cify to what ex­tent em­ploy­ers should create in­cen­ti­ves to use in­ter­nal re­por­ting pro­ce­du­res first. Since the whist­leb­lo­wer should pre­fer the in­ter­nal re­por­ting chan­nels if there is no fear of re­pri­sals and it can be ex­pec­ted that ef­fec­tive ac­tion will be ta­ken against the vio­la­tion, this can be seen as an ex­pli­cit ap­peal by the le­gis­la­tor for cor­re­spon­ding pro­fes­sio­nal in­ter­nal struc­tures. Only if whist­leb­lo­wers can trust that aut­ho­ri­ties will take the in­for­ma­tion se­riously, fol­low it up care­fully and cla­rify pu­nis­hable of­fen­ces or ir­re­gu­la­ri­ties, as well as sanc­tion of­fen­ces, will they pre­fer these in­ter­nal re­por­ting struc­tures as en­vi­sa­ged.

Protective effect for the whistleblower

Whist­leb­lo­wers only enjoy le­gal pro­tec­tion if there was a re­ason­able be­lief that the in­for­ma­tion about vio­la­ti­ons re­por­ted was true at the time the re­port was made, that it falls wi­thin the scope of the law and that it has been sub­mit­ted th­rough the in­ter­nal or ex­ter­nal re­por­ting chan­nels pro­vi­ded for. Sub­ject to these pre­con­di­ti­ons, the law pro­hi­bits any form of re­pri­sals, dis­cre­pan­cies or com­plaints. The whist­leb­lo­wers do not have to fear any con­se­quen­ces un­der em­ploy­ment law in the event of a pro­per no­ti­fi­ca­tion. In the case of a la­bor law pro­cess, a re­ver­sal of the bur­den of proof in fa­vour of the whist­leb­lo­wer is pro­vi­ded for. Ac­cor­din­gly, the em­ployer must prove that there was no con­nec­tion with the re­por­ting of the notice by the em­ployee. In the event of a vio­la­tion of the pro­hi­bi­tion of re­pri­sals, the em­ployee shall be en­tit­led to com­pen­sa­tion for fi­nan­cial los­ses.

Vio­la­ti­ons are sanc­tio­ned with se­vere fi­nes of bet­ween 10,000 and 50,000 eu­ros. For the non-es­ta­blish­ment of a cor­re­spon­ding in­ter­nal re­por­ting of­fice, the fi­nes are only im­po­sed with a tran­si­tio­nal pe­riod of six months and thus from the sixth month af­ter pro­mul­ga­tion. The fi­nes can af­fect both the per­sons re­spon­si­ble and the re­spec­tive com­pa­nies. Note that in cer­tain ca­ses the fine against the com­pany can in­crease ten­fold!

Urgent need for action!

Com­pa­nies in Ger­many must now act. This me­ans that in par­ti­cu­lar lar­ger com­pa­nies (249 em­ployees or more) must im­me­dia­tely im­ple­ment a whist­leb­lo­wer sys­tem that meets the re­qui­re­ments of the Whist­leb­lo­wer Pro­tec­tion Act in or­der to avoid fi­nes. Howe­ver, even small com­pa­nies in Ger­many must ad­apt to the new re­gu­la­ti­ons, as whist­leb­lo­wing sys­tems have not exis­ted there on a re­gu­lar ba­sis to date and this le­gal ob­li­ga­tion will af­fect them as early as the end of 2023. If such sys­tems al­re­ady exist, they of­ten at least do not meet the le­gal re­qui­re­ments and now have to be ad­op­ted. In this re­spect, it is ad­visa­ble to deal with the im­ple­men­ta­tion of such a sys­tem, in­clu­ding the le­gal frame­work re­qui­re­ments, as soon as pos­si­ble and to ent­rust peo­ple with the up­com­ing tasks.

To en­sure that em­ployees do not turn to ex­ter­nal re­por­ting of­fices, the em­ployees must be in­for­med com­pre­hen­si­vely about the use of the in­ter­nal whist­leb­lo­wer sys­tem at an early stage. In ad­di­tion, a com­pany-in­ter­nal whist­leb­lo­wer gui­de­line should be im­ple­men­ted or em­bed­ded in a Code of Con­duct.

In or­der to al­low suf­fi­ci­ent time for the tech­ni­cal im­ple­men­ta­tion and the im­ple­men­ta­tion of other le­gal re­qui­re­ments, e. g. co-de­ter­mi­na­tion rights of the works coun­cil or re­qui­re­ments un­der data pro­tec­tion law, the mea­su­res should de­fi­ni­tely be star­ted now at the la­test.