Implementation of the EU Whistleblowing Directive in Germany

UPDATE: Implementation of the EU Whistleblowing Directive in Germany - the new Whistleblower Protection Act enters into force in mid-June 2023

The German Bundestag and the German Bundesrat approved the draft bill for the new Act for Better Protection of Whistleblowers (Whistleblower Protection Act, "HinSchG") on 11 and 12 May 2023. The HinSchG enter into force on 02 July 2023.

With the entry into force of the HinSchG, the Directive on the Protection of Persons Reporting Breaches of Union Law ([EU] 2019/1937), "EU Whistleblowing Directive") is now also being implemented in Germany - with considerable delay. After the German Bundesrat in February 2023 refused to give its consent to the Act originally passed by the German Bundestag in December 2022, the subsequently convened Conciliation Committee agreed on a compromise on 9 May 2023. On 11 May 2023, the German Bundestag approved the amendments to the HinSchG in the Conciliation Committee's recommended resolution, which were of little significance overall. The Bundesrat also gave its consent to the amendment on 12 May 2023. It is expected that the HinSchG will be signed by the President of the Federal Republic of Germany and promulgated in the German Federal Law Gazette in the near future. The HinSchG will then enter into force one month after publication - probably as early as mid-June 2023.

For all employers with more than 50 employees as well as all companies in the financial industry, regardless of their number of employees, there is therefore an urgent need for action. For smaller companies with generally 50 up to 249 employees - with the exception of companies in the financial industry - a transitional period until 17 December 2023 is provided for the establishment of an internal reporting office.

We therefore recommend a timely and proactive implementation of the requirements of the HinSchG - by introducing internal reporting offices or reviewing and adapting already existing ones. The obligation to establish internal reporting offices could apply as early as mid-June 2023. In companies where a works council has been established, its co-determination rights must also be observed when introducing reporting systems and, if necessary, works agreements must be negotiated, which experience shows can take some time.

Our team of compliance and employment law experts advises comprehensively and competently on all implementation issues. Dr. Hans Hermann Aldenhoff, Dr. Sascha Morgenroth, Sascha Kuhn and Dr. Annika Scheske are available to answer your questions.

What changes compared to the HinSchG draft from December 2022 does the now passed law provide for?

Overall, the changes made compared to the HinSchG draft from December 2022 do not have much impact. In particular, the requirements for the obligation to introduce an internal reporting system remain unchanged.

Compared to the version originally passed by the German Bundestag, the HinSchG now passed stipulates that external and internal reporting offices are no longer obliged to enable and process anonymous reports. Anonymous reports "shall" be investigated, but there is no obligation to do so.

Irrespective of this, however, companies are still well advised to allow anonymous reports and to follow up on them. Experience has shown that allowing anonymous reporting contributes to employees' trust in a whistleblowing system. It gives the company the opportunity to uncover serious grievances, which are often initially reported anonymously, and thus reduce or avert risks to business operations. Experience has shown that the potential for abuse of anonymous reporting, which has been widely criticised, is very rarely realised in practice.

In addition, employees should now prefer to report to an internal reporting office if the violation can be effectively dealt with internally. In principle, the choice of reporting channel is left to the whistleblowers themselves. However, companies should have their own interest in making the use of internal reporting channels attractive and providing them with corresponding trustworthy means. In the case of internal reports, companies are initially in a position to take remedial action. This possibility is considerably restricted in the case of external reports.

The HinSchG, which has now been passed, also provides for a reversal of the burden of proof in favour of whistleblowers with regard to the question of whether a measure taken constitutes a reprisal. In concrete terms, this means that in the event of a dispute, employers must prove that (labour law) measures taken against whistleblowers, such as a warning, transfer or dismissal, are precisely not a reaction to the report. In contrast to the previous draft law, however, the HinSchG provides for whistleblowers to explicitly invoke discrimination on the grounds of the report.

The amendment to the HinSchG therefore does not have a significant impact in practice. The reversal of the burden of proof will increase the litigation risk for employers in disputes with whistleblowers, coupled with a certain risk of abuse. The labour courts will have to deal with the details of the reversal of the burden of proof. Employers are therefore all the more well advised to document in detail any (labour law) measures taken against whistleblowers and their necessity.

The initially envisaged fine was reduced to a maximum of EUR 50,000.00 instead of EUR 100,000.00. In addition, the claim for damages for pain and suffering last provided for in the HinSchG draft has been deleted. Both changes are to be welcomed. Even though experience has shown that the maximum fine would only be levied by the competent authorities in exceptional cases of massive violations of the law, a fine below the maximum amount of EUR 50,000.00 would still be high, especially for small and medium-sized enterprises.

What is the aim of the HinSchG?

The HinSchG implements the requirements of the EU Whistleblowing Directive, which was intended to create a uniform legal framework for the implementation of reporting systems and to strengthen the protection of whistleblowers. The EU member states were given a deadline of 17 December 2021 to transpose the directive into national law, which has passed without result in Germany.

The aim of the HinSchG as a transposition law of the EU Whistleblowing Directive is thus primarily to strengthen the protection of whistleblowers. In doing so, the HinSchG even goes beyond the requirements of the EU Whistleblowing Directive.

Who is subject to the obligations under the HinSchG?

The HinSchG obliges all employers with usually at least 50 employees to set up internal reporting offices and to ensure that the persons appointed for this purpose have the necessary expertise (sec. 12 para. 1 and 2 HinSchG). Irrespective of the number of employees employed, the obligations of the HinSchG apply to securities trading companies, credit institutions and other financial institutions (sec. 12 para. 3 HinSchG). This is to ensure a far-reaching and uniform level of protection.

Employers within the meaning of the HinSchG ("Beschäftigungsgeber") are all natural and legal persons, partnerships with legal capacity as well as other associations of persons with legal capacity where at least one person is employed. Due to the broad definition of an employer, the obligations of the HinSchG therefore affect not only companies with their registered office in Germany, but also foreign companies and branches.

What are the implementation deadlines?

Companies with 250 or more employees as well as employers in certain sectors, in particular financial institutions, must have set up an internal reporting office that complies with the requirements of the HinSchG no later than three months after the promulgation of the HinSchG.

For companies employing between 50 and 249 people, the obligation will only apply from 17 December 2023.

Deviating from this, a uniform extended deadline as of 1 January 2025 applies to the implementation of anonymous reporting channels (sec. 42 para. 2 HinSchG).

Which misconduct is covered by reports under the HinSchG?

The scope of application of the HinSchG goes beyond that of the EU Whistleblowing Directive. In particular, not only reports of violations of EU law but also of national law are covered by the HinSchG.

The HinSchG, which has now been passed, provides for a limited scope of application. According to the amendment to the draft law, information on violations shall only fall within the scope of the law if it relates to the employer or another body with which the whistleblower had professional contact.

In other respects, the HinSchG applies in particular particularly applies to reports and the disclosure of information on misconduct, with regard to (non-exhaustive list, cf. sec. 2 para. 1 HinSchG):

• Criminal provisions,
• Regulations subject to fines, insofar as the violated regulation serves to protect life, limb or health or to protect the rights of employees or their representative bodies,
• Regulations to combat money laundering and terrorist financing,
• Regulations on transport safety, as well as
• Health, data and environmental protection regulations.

How is an internal reporting office to be set up and what are its tasks?

Internal reporting offices are primarily responsible for receiving reports via the established reporting channels. After receiving a report, the internal reporting office is responsible for further clarification of the facts and the necessary validity assessment. Based on this, the internal reporting office shall initiate follow-up measures required in the individual case.

Initially, individuals employed by or departments of the respective employer can be appointed as an internal reporting office. The decisive factor is that all persons appointed as an internal reporting office have the skills, powers and resources to fulfil the tasks of an internal reporting office required by the HinSchG. Therefore, employees in compliance departments, in-house lawyers or data protection officers are often appointed as internal reporting office(s).

The persons entrusted with the tasks of the internal reporting office may at the same time be entrusted with other (employment) tasks. However, the employer must ensure that the persons appointed as internal reporting office are able to carry out their duties independently. When exercising dual functions, employers should pay particular attention on identifying potential conflicts of interest before appointing individual persons or departments and taking countermeasures.

Is it possible to appoint an external party as internal reporting office?

Yes, an external third party (e.g. a law firm or an ombudsperson) can also be appointed as an internal reporting office (sec. 14 para. 1 HinSchG). In doing so, however, companies must ensure that also the external third party has the skills, powers and resources to fulfil the tasks as an internal reporting office in compliance with the requirements of the HinSchG. The responsibility for the internal reporting office therefore remains with the company even if an external third party is commissioned.

In addition, the HinSchG provides that appointing an external third party as internal reporting office does not release the company from the obligation to take "appropriate measures" to remedy potential misconduct.

Is it possible to establish a group reporting office as internal reporting office?

Yes, the HinSchG allows the establishment of a cross-company internal reporting office at a group company (so-called group solution), but only for companies with up to 249 employees. Employers with 250 or more employees must set up their own internal reporting office without exception, i.e. the use of a group reporting office is not permitted.

The possibility of using a group reporting office contradicts the EU Commission's statement in this regard, according to which each company must have its own internal reporting office, i.e. an internal reporting office at group level would not be sufficient. According to information from the German Government, however, discussions with the EU Commission had taken place before the HinSchG was passed, in which the possibility of using a cross-company internal reporting office at group level was confirmed.

With regard to the legitimacy of the group solution, the German Government correctly justified: For affiliated companies, the concentration of expertise for the processing of internal reports is often of great importance in order to ensure fast and professional case processing. On the one hand, this ensures a high level of protection for whistleblowers, but on the other hand, it also enables the group of companies to more specifically identify group-wide problems and their releases and to take effective remedial measures.

For group companies with fewer than 250 employees, the option of using a group reporting office as internal reporting office therefore has considerable advantages, also in terms of saving resources and the associated costs.

Who are the external reporting bodies?

It is envisaged that the German Government will establish an office for external reports at the Federal Office of Justice ("BfJ") (sec. 19 HinSchG). The tasks of this external reporting office shall be carried out independently besides the other tasks of the BfJ. In addition, the German Government intends to establish further external reporting offices. Details on this are not yet available.

In addition, each Federal State can set up its own external reporting office for external reports (sec. 20 HinSchG). Furthermore, the Federal Financial Supervisory Authority ("BaFin") as well as the Federal Cartel Office can be called upon by whistleblowers as an external reporting office in their respective competence areas.

How must the whistleblowing be enabled?

Initially, whistleblowers have the choice of contacting an internal or external reporting office (sec. 7 para. 1 HinSchG). However, the HinSchG, which has now been passed, provides that whistleblowers should be given preference to reporting to an internal reporting office in cases where effective action can be taken internally against violations (section 7 para. 1 sentence 2 HinSchG. Furthermore, the HinSchG provides that companies should provide for "incentives" to encourage whistleblowers to use the internal reporting office first (sec. 7 para. 3 HinSchG). What exactly these incentives should look like is not regulated in the HinSchG and is therefore left up to the companies themselves. In addition, external reporting offices are required to emphasise the possibility of internal reporting when receiving reports externally (sec. 24 para. 2, sec. 28 para. 1 HinSchG).

Internal reports can be made through the reporting channels set up by the respective company. The internal reporting channels must ensure both oral and textual reporting. Oral reporting also includes reports by telephone or other means of voice transmission. If whistleblowers request it, a personal reporting meeting must also be enabled. With the consent of the whistleblower, the personal meeting can also take place by means of video and audio transmission.

Do anonymous reports need to be enabled and tracked?

No, in contrast to the previous draft legislation, the HinSchG now provides that companies should enable anonymous contact and communication between the whistleblower and the respective reporting office (sec. 16 and sec. 27 HinSchG). The Conciliation Committee has refrained from making this provision mandatory ("must"), contrary to the previous draft bill. In this way, the HinSchG that has now been passed takes into account the criticism of CDU-governed Members of the German Bundesrat, who feared the danger of abuse of the anonymous reporting channel. However, experience shows that this risk of abuse is very rarely realised in practice, so that companies are well advised to allow anonymous reports and to follow them up. This can strengthen trust in the reporting system. In addition, anonymous reports offer companies the opportunity to uncover abuses, reduce risks and ensure business operations.

What should be done with reports after they have been received?

First of all, the whistleblower must receive confirmation of the receipt of a report as well as the status of the procedure from the reporting office that received the report (see below).

In addition, the HinSchG stipulates that the respective reporting offices must document all incoming reports in a permanently retrievable manner (sec. 11 HinSchG). However, the requirement of confidentiality must always be observed (sec. 8 HinSchG). In the case of reports made by telephone (or reports by means of another form of voice transmission), a permanent audio recording of the conversation or the transcript (verbatim record) may only be made with the consent of whistleblower. Without such consent, only a summary of the report may be documented (content record). The whistleblower must be given the opportunity to review the record, correct it if necessary and confirm it.

After receiving the report, the respective reporting office is obliged to assess the validity of the report received. For this purpose, the reporting office may, if necessary, ask the whistleblower for further information and initiate follow-up measures, such as internal investigations.

The respective reporting office is obliged to keep the person providing the information informed about the status of the procedure (see below).

Documentation of a report and the ensuing proceedings must be deleted three years after the conclusion of the proceedings.

How must feedback be given to whistleblowers and what deadlines apply?

The respective reporting office must acknowledge receipt of the report to whistleblower within seven days of its receipt.

In addition, internal reporting offices must provide whistleblower with feedback on the status of the procedure within three months after confirmation of receipt of the report, or, if receipt was not confirmed, no later than three months and seven days after receipt of the report (sec. 17 para. 2 HinSchG). External reporting offices have up to six months to do so in particularly extensive cases.

The feedback includes the notification of planned as well as already taken follow-up measures and the reasons for these. However, the whistleblower will only receive feedback if this does not affect the investigation or the rights of the persons who are the subject of a report or who are named in the report (sec. 17 para. 2 HinSchG).

What protections are provided for whistleblowers?

According to the HinSchG, whistleblowers cannot be held legally responsible for obtaining (or accessing) information that they have reported or disclosed, unless the obtaining of the information itself constitutes a separate criminal offence.

Any reprisals against whistleblowers are prohibited (sec. 36 HinSchG). This also includes the threat and attempt of reprisals. Therefore, any legal consequence that constitute reprisals, such as the termination of the employment relationship of the whistleblower or his or her transfer due to whistleblowing, are null and void due to the violation of a prohibition law (sec. 134 German Civil Code (BGB)). In this respect, the HinSchG even goes beyond the protective measures provided for in the EU Whistleblowing Directive.

The HinSchG also provides for a reversal of the burden of proof, in line with the requirements of the EU Whistleblowing Directive: If a whistleblower suffers a disadvantage in connection with his or her professional activity after a report, the disadvantage is presumed to be a reprisal. However, according to the HinSchG that has now been passed, this should only apply if the whistlerblower also asserts this himself/herself within the framework of legal proceedings and invokes this fact. The person who has acted disadvantageously (i.e. in most cases the company as employer) has to prove that the disadvantage is based on sufficiently justified reasons and that it was not based on the whistleblowing.

The HinSchG also provides that whistleblowers who suffer reprisals as a result of whistleblowing are not only entitled to compensation for all pecuniary losses incurred as a result, but also to immaterial compensation (e.g. compensation for pain and suffering, sec. 37 para. 1 HinSchG).

In order to effectively protect whistleblowers, agreements that deviate from the protective measures of the HinSchG are explicitly prohibited and thus invalid in any case.

With regard to the aforementioned protection of whistleblowers, it is irrelevant whether the report subsequently turns out to be true. However, it is required that the report was made in good faith. This means that whistleblowers who have intentionally or grossly negligently reported false information are not protected. In this case, the whistleblower is liable for any damages (sec. 38 HinSchG).

What are the consequences of not implementing the obligations according to the HinSchG?

If companies do not implement the requirements resulting from the HinSchG in time, they are acting in breach of statutory provisions and can be fined. The fines can be of a sensitive height. For example, the HinSchG provides for a fine of up to 20,000 EUR for the violation mentioned as an example, and a fine of up to 50,000 EUR for obstructing a report.

What are the concrete obligations for companies to which the HinSchG applies?

Companies should implement a whistleblowing system that complies with the requirements of the HinSchG or review an already established system for its legal conformity. The main questions will probably concern the staffing of the internal reporting office as well as the determination of the person responsible for processing the information (individual or department, group reporting office or external third party).

If there is a works council established within the company, it must be regularly involved in the implementation or modification of a whistleblowing system (sec. 87 para. 1 nos. 1, 6 Works Constitution Act (BetrVG)).

Due to the reversal of the burden of proof provided for in the HinSchG, employers are also well advised to ensure careful documentation of breaches of duty, especially in the case of employees who are or have also been whistleblowers.

Whistleblowing systems as business opportunity?

In view of the considerable effort that many companies have to face due to the new HinSchG, it is certainly helpful to understand whistleblowing as an opportunity and part of good corporate governance. Every whistleblowing report provides for an opportunity to identify problem and risk areas within the company, take countermeasures and thereby contribute to the protection of the company and its effectiveness.

In order to use whistleblowing systems efficiently and in particular to ensure that they are used to report potential misconduct for which they were actually set up, companies are also advised to pay attention to a suitable communication strategy and appropriate training for their employees from the very beginning.