February 9, 2023

Better late than never: The Whistleblower Protection Act on the home stretch

Whistleblower protection becomes law

After years of discussion on the implementation of the EU Whistleblower Directive (EU 2019/1937), the German Whistleblower Protection Act (HinSchG) is now on the home stretch. It passed the Committee on Legal Affairs and was adopted by the German Bundestag (parliament). Now the German Bundesrat (representation of the federal state governments) still has to approve the law. The law will come into force three months after its promulgation, probably in April or May 2023.

The aim of the Act is to provide better protection in the future for natural persons who, in connection with their professional activities or in the run-up to professional activities, have obtained information about violations (of a limited catalog of standards) and report or disclose such information to the reporting bodies provided for under the Act (“whistleblowers”). The existing protection for whistleblowers in Germany is incomplete and inadequate, and employees often remain silent for fear of professional consequences. And this, even though they are the ones who discover malpractices such as corruption and tax fraud first and who, by reporting or disclosing them, could contribute to the discovery and prevention of violations of the law, also in the interests of the company.

The improved protection of whistleblowers intended by the HinSchG is to be achieved through a uniform system of protection, the central elements of which are internal and external reporting offices and the prohibition of reprisals.

What has happened so far?

The EU Whistleblower Directive (EU 2019/1937), on which the law is based, should already have been transposed into national law by December 17, 2021. However, as the previous government was unable to agree on a common way to implement it, the deadline passed without a corresponding German implementation law. The EU Commission therefore initiated formal infringement procedure against Germany in February last year. Germany is threatened with legal action before the European Court of Justice.

On July 27, 2022, the new German government adopted a draft law to implement the directive, which the German Bundestag debated at first reading on September 29, 2022. On December 14, 2022, the draft passed through the Committee on Legal Affairs after amendments were made, among other things, to the handling of anonymous reports. On December 16, 2022, the German Bundestag also passed the law.

What does the Whistleblower Protection Act contain?

  • Scope of application: The personal scope of application of the HinSchG is broad. It includes employees and civil servants, but also self-employed persons, shareholders, trainees, employees of suppliers and even persons who are in a pre-contractual stage.

The material scope of application includes the reporting and disclosure of information on violations of penal norms, on violations of fine-protected standards, insofar as the violated standard serves to protect life, limb or health or to protect the rights of employees or their representative bodies. In addition, the scope of application also extends to other violations of federal and state laws and directly applicable legal acts of the European Union in certain regulatory areas, such as regulations with requirements for environmental protection or nuclear safety. Reporting of anti-constitutional statements by civil servants is also covered by the Whistleblower Protection Act.

  • Establishment of reporting offices: The core of the whistleblower protection system is the establishment of internal and external reporting offices that must check incoming reports and then take follow-up action.

    Employers with more than 50 employees must ensure that at least one internal reporting office is established and operated. This applies to both public sector and private sector employers. Employers with more than 249 employees must establish such an office by the effective date of the Act, while companies with fewer employees have time until December 17, 2023 to do so. For the latter, there is also the option of establishing a joint reporting office. Companies belonging to corporate groups also have the option of setting up a joint reporting office. In addition, it is possible to outsource the reporting office to an external ombudsperson, such as a law firm.

    The Bundesamt für Justiz (Federal Office of Justice) establishes an external reporting office. In addition, the federal states can set up their own external reporting offices. The whistleblower systems already established at the Bundeskartellamt (Federal Cartel Office) and the Bundesanstalt für Finanzdienstleistungsaufsicht (Federal Financial Supervisory Authority) will be continued as external reporting offices with special responsibility.
  • Precise design and deadlines: The reporting offices must enable whistleblowers to provide information orally, in writing and, if the whistleblower so desires, in person. The reporting offices must confirm the receipt of the report to the whistleblower within seven days and inform the whistleblower within three months of what follow-up action has been taken.
  • Free choice of the reporting office: Whistleblowers are free to choose whether to contact an internal or external reporting office. However, employers should provide incentives for whistleblowers to contact the internal reporting office first by providing clear and easily accessible information about the reporting process.
  • Anonymous reports: While the original draft law only provided that reporting offices should also deal with anonymous reports, the bill was amended in the Committee on Legal Affairs so that the reporting offices now have to deal with anonymous reports and have to provide reporting channels that allow anonymous contact.
  • Disclosure: Whistleblowers should only be allowed to contact the public with their information under strict conditions. This is the case, for example, if there is otherwise a risk that evidence will be suppressed, if there is a risk of irreversible damage, or if the whistleblower has already contacted an external reporting office and the latter has not taken the necessary measures.
  • Confidentiality requirement: Reporting offices must protect the identity of the person providing the information as well as those persons who are the subject of the report. In principle, the identity of these persons may only be known to the persons responsible for processing the respective report. Exceptions to the confidentiality requirement exist, among other things, if a person intentionally or through gross negligence reports incorrect information or in criminal proceedings at the request of the prosecuting authorities.
  • Protection against reprisals: To protect whistleblowers, there is a prohibition of reprisals. Reprisals are all unjustified disadvantages in connection with a person’s professional activities, for example dismissals, warnings, disciplinary measures and bullying, which a whistleblower suffers as a result of a report or disclosure. In this respect, a reversal of the burden of proof applies in favor of the whistleblowing person. The employer must prove that the disadvantage was not due to the report or disclosure.
  • Claims for damages: The HinSchG contains two special damage compensation rules. The whistleblower is entitled to compensation for damage caused by a violation of the prohibition of reprisals, even if the damage is not pecuniary. However, a whistleblower shall also be liable for damages if he or she causes damage through intentional or grossly negligent reporting or disclosure.
  • Fines: Violations of the main provisions of the HinSchG constitute administrative offenses and are therefore subject to fines. For whistleblowers, this applies if they knowingly disclose inaccurate information. For employers, this applies, for example, if they do not set up an internal reporting office, if they obstruct a report or communication mentioned therein, or if they intentionally or recklessly fail to maintain confidentiality.

What is criticized about the Whistleblower Protection Act?

Criticism of the new Whistleblower Protection Act comes, among others, from the Gesellschaft für Freiheitsrechte (GFF), which welcomes the improved protection for whistleblowers but considers it still insufficient. The GFF criticizes in particular the fact that information about other misconduct, such as abuse of power, and violations of the General Equal Treatment Act are not covered by the material scope of protection of the HinSchG. It is also problematic that secret services are exempt from the HinSchG and that authorities can classify documents as confidential, which means that the HinSchG is not applicable.

The CDU/CSU, on the other hand, criticized that the HinSchG would burden companies with additional costs and bureaucracy, especially due to the obligation to introduce anonymous reporting channels. Furthermore, the HinSchG contains too many indeterminate legal terms and the relationship to other reporting systems, such as under the Act on Corporate Due Diligence Obligations in Supply Chains, has not been clarified. Likewise, the relationship between the external reporting offices and other authorities is not coordinated. The HinSchG is therefore legally uncertain and impracticable and therefore also a great burden for the courts.

What should companies do now to be compliant?

  • Act early: Since the introduction of a whistleblower system is complex, all companies with more than 50 employees should start preparing now to set up professional compliance structures. There is an urgent need for action, especially for companies with at least 250 employees, as the obligation will apply to them as soon as it comes into force.
  • Involve the works councils: Companies with works councils should plan for a longer lead time because of the works council’s co-determination rights, as they must first conclude a works council agreement.
  • Check existing systems: Companies that have already introduced a whistleblower system should check whether it meets the requirements of the HinSchG. In particular, the documentation and information requirements must be observed. In addition, the requirements of the EU General Data Protection Regulation (DSGVO) must be observed.
  • Using digital solutions: A particular challenge in practical implementation is that companies must provide a system that enables both anonymous contact and anonymous communication with the whistleblower. Classic reporting channels, for example via a mailbox or an e-mail address, are not sufficient for this purpose. However, the legal obligation can be fulfilled quickly and easily using  for example a digital whistleblowing system.
  • Solutions for small and medium-sized companies: It is also possible for small and medium-sized companies to implement a whistleblower system inexpensively, for example by introducing a digital system and working together with an external ombudsperson.
  • Good corporate culture: The system will be particularly successful if it is embedded in a transparent and trusting corporate culture. In this case in particular, the introduction of a well-functioning internal whistleblower system also represents a major opportunity for companies, as it enables them to respond quickly to grievances and thus avert damage to their reputation.
Photo of Dr. Nadine Kramer Dr. Nadine Kramer

Dr. Nadine Kramer is a special counsel in Covington’s labor and employment law and executive compensation and employee benefits department. She has many years of experience in advising on labor law aspects with respect to M&A transactions, complex HR topics and reorganizations, especially…

Dr. Nadine Kramer is a special counsel in Covington’s labor and employment law and executive compensation and employee benefits department. She has many years of experience in advising on labor law aspects with respect to M&A transactions, complex HR topics and reorganizations, especially with a focus on negotiations with works councils, and a corresponding networking within the law firm as well. Furthermore, she has a great experience in drafting of social plans, evaluating of pension liabilities and managing labor law-related proceedings, especially with regard to wrongful termination litigations at all levels of seniority and management participation programs.

Photo of Walter Born Walter Born

Walter Born is a partner in the Frankfurt office. He advises clients on a variety of legal and business issues, with an emphasis on restructuring measures and the negotiation of reconciliation of interests and social plans, outsourcing transactions and German TUPE provisions, employee…

Walter Born is a partner in the Frankfurt office. He advises clients on a variety of legal and business issues, with an emphasis on restructuring measures and the negotiation of reconciliation of interests and social plans, outsourcing transactions and German TUPE provisions, employee data protection, dismissals (mass lay-offs) and related litigation, internal investigations, employee benefits and ERISA litigation. Walter counsels clients on employment advice, including drafting employment, managing directors’ and board members’ contracts and settlement agreements. He also has experience advising on collective labor law matters, and counsels on immigration matters, social security law, enforceability of post-contractual non-compete covenants and many other related matters. Walter Born is Managing Partner for Legal Personnel of the Frankfurt office.