The German Whistleblower Protection Act

The Whistleblower Protection Act transposes the requirements of the EU Whistleblower Directive into German law with – the now almost usual – delay. After much back and forth between the German legislative bodies (Bundestag and Bundesrat) during the legislative process and against the background of an infringement action brought by the EU Commission, the new law finally entered into force on 2 June 2023.

What does the Whistleblower Protection Act want?

The Whistleblower Protection Act is intended to protect persons who, in the course of their professional activities, have gained knowledge of violations of statutory provisions or other binding policies and report them. Such whistleblowers must be able to disclose wrongdoings without fear of reprisals.

In itself, it should also be in the interest of the respective organisation to learn about violations as early as possible in order to be able to remedy them quickly. Compliance as a general goal is also supported by the law. Unfortunately, however, it is by no means a matter of course that persons who disclose wrongdoing actually remain unchallenged. For this reason, the Whistleblower Protection Act prohibits issuing warnings to whistleblowers or otherwise disadvantaging them in any way as a result of their whistleblowing.

Of course, the protection of the whistleblower only applies if the report was not abusive, grossly negligent or even deliberately false. In such cases, it remains possible to take action against the reporting person and, for example, to assert claims for damages.

For the consistent protection of whistleblowers, a reversal of the burden of proof applies in the case of reprisals in connection with a report that has been made. For example, if a report of a violation is followed by a dismissal, a connection is presumed and the employer must disprove this. The whistleblower must be compensated for any damages caused by the reprisals.

Of course, the Whistleblower Protection Act also contains the appropriate levers to ensure enforcement. Violations of central requirements (such as not setting up an internal reporting channel) can be punished with fines of up to 50,000 euros.

Which reports are covered by the law?

According to section 2 of the HinSchG, all reports of criminal offences fall under the protection, which in itself makes the scope of application quite large.

However, violations that are only punishable by a fine are also covered if the violated regulation serves to protect life, limb or health or to protect employees or their representative bodies. Thus, for example, violations of the Road Traffic Act are already within the scope of application, as is non-compliance with regulations on minimum wage or working hours.

In addition, some selected regulations fall under the scope of application, for example from antitrust law, environmental law, radiation protection, food and product safety. Policies on the prevention of money laundering and combating the financing of terrorism are also covered, as are consumer and data protection.

In individual cases, it can be difficult to decide whether a violation is covered by whistleblower protection. It is not necessarily obvious that violations of other German legislation, such as the AGG, are not covered. Against this background, companies are also well advised to choose the reporting channel carefully in order to ensure that, in addition to correct treatment, well-intentioned but misplaced reports are also handled with appropriate sensitivity.

What does the law say about hotlines?

First of all, a distinction must be made between internal and external reporting channels. In principle, whistleblowers are free to choose whether to contact an internal or external reporting channel. The law merely recommends that whistleblowers should preferably turn to an internal reporting channel, provided that effective action can be taken against the violation and no reprisals are to be feared. External reporting channels should then only be notified if no internal remedy has been taken.

External is understood to mean the reporting channel set up by the federal government or the regional provinces and some supervisory authorities.

The term internal reporting channel is slightly misleading. All hotlines that an organisation appoints itself are considered internal. This means both hotlines that are set up within the organisation and those for which a service provider is used. It is therefore not necessary to train and deploy one’s own staff. It is possible to outsource the task to bodies outside the organisation, such as lawyers, without further ado. This is called a whistleblowing ombudsperson.

The only imperative is that the reporting channel can act neutrally, independently and reliably. In the example of the lawyers mentioned above, the lawyers should not represent the company at the same time, as this would involve a conflict of interest.

At this point, a brief note for companies with employee representation through works councils: The establishment of the reporting channel is subject to co-determination by the employee representatives.

Different policies apply to the establishment of an internal reporting channel, mostly depending on the number of employees.

  • Less than 50 employees: These companies do not have to set up an internal reporting channel. However, this does not mean that the regulations on whistleblower protection as a whole are not applicable! The law applies in principle to all companies and organisations.
  • 50 to 249 employees: The reporting channel is to be established by 17 December 2023.
  • 250 or more employees: Companies had to set up internal hotlines within three months, so this deadline has already passed.
  • For some industries, such as the financial and insurance sectors, the obligation to establish internal reporting channels applies regardless of the number of employees and upon entry into force of the law.

Reporting channels must accept information verbally, in writing (e.g. by means of a whistleblowing system or e-mail) and also in person if the whistleblower so wishes. Organisations are free to decide whether they offer the possibility of anonymous reporting. The legislator has not been able to bring itself to prescribe such a possibility.

Notwithstanding this, the identity of the whistleblower and the persons affected by the report are subject to special protection. In principle, the identity may only be disclosed to employees who are specifically responsible for handling the report. Exceptions apply, of course, if the report is investigated in the context of criminal prosecution.

The reporting channel must carefully and permanently document all reports. Special rules apply to oral reports if a recording or verbatim record is to be made.

Conclusion: The grace period is (soon) over.

All organisations should now know whether they need a whistleblowing system, possibly combined with a whistleblowing ombudsperson, and if so, act quickly.

The involvement of a body outside the organisation can increase the confidence of whistleblowers that reports will be handled correctly, objectively and confidentially. This makes it more likely overall that reports will be made internally.

Our experienced lawyers offer you trustworthy and efficient (pre-)processing of incoming notifications in a technically secure and reliable portal environment, so that you can concentrate on the essential things. We will be happy to advise you on this.

Whistleblower system with Whistleblowing Ombudsperson

Build trust with your employees and achieve compliance with the German Whistleblower Protection Act.

Contact us!

Secure the knowledge of our experts!

Subscribe to our free newsletter: