EU Whistleblowing Directive - Germany

Existing whistleblower protection

In Germany, whistleblower protection is still considered to be limited compared to the directive. So far, whistleblower protection has been shaped primarily by case law. In particular, civil and labour courts are guided by the requirements of the European Court of Human Rights (ECHR). There are currently only national regulations on whistleblower protection for the financial services sector (sec. 4d para. 6 FinDAG) and regarding the protection of business secrets (sec. 5 GeschGehG).

Implementation perspective and recommended actions for German employers

According to the new coalition agreement of 8 December 2021, agreed within the new federal government, (the Coalition Agreement consisting of social democrats (SPD), the green party (BÜNDNIS 90/DIE GRÜNEN) and the liberals (FDP)), the EU Whistleblower Directive, whose transposition deadline had expired on 17 December 2021, is to be transposed into German law in a “legally secure” manner. As the last draft of a “Whistleblower Protection Act” already provided, whistleblowers are to be protected not only when reporting breaches of EU law, but also when reporting breaches of regulations or other significant misconduct, the disclosure of which is in the special public interest. Accordingly, the new German government adheres to an overreaching implementation of the EU Directive.

The German implementation law of the EU Whistleblowing Directive, the Whistleblower Protection Act (Hinweisgeberschutzgesetz, “HinSchG”), finally entered into force on 2 July 2023 – one month after its publication in the Federal Gazette early June – with only minor changes to the draft law as of December 2022. This means that, after a considerable delay, the EU Whistleblowing Directive has now been implemented in Germany. All legal entities employing more than 50 employees in Germany and all financial institutions, regardless of the number of employees, are therefore now obliged to maintain an internal reporting system that meets the requirements of the HinSchG as of 2 July 2023.

For all employers with more than 50 employees as well as all companies in the financial industry, regardless of their number of employees, an urgent need for action is therefore required. For small companies with usually 50 up to 249 employees – with the exception of companies in the financial industry – a transitional period until 17 December 2023 is provided for the establishment of an internal reporting office.

We strongly recommend a timely implementation of the requirements of the HinSchG – by introducing internal reporting offices or reviewing and adapting already existing ones.

German draft law on whistleblower protection

The Act primarily aims to create legal clarity for whistleblowers as to when and how they are protected when reporting or disclosing violations. Further, it will clarify for businesses and administrations how to deal with a report and the legal consequences. The main aspects of the Act are:

• Scope: All persons who have obtained information about violations in their professional environment and those connected to them in a work-context (colleagues) are covered by the Act. In contrast to the Directive, there is no specific list of the protected group of persons; only the purely private acquisition of information is excluded.

• Group companies: The EU Directive stipulates that every company that exceeds a required number of employees must set up its own internal reporting office. Therefore, for a group of companies, one reporting office for the whole group will no longer be sufficient. The German federal government now explicitly proposes a so-called “group privilege” for legal entities employing <250 employees, i.e. group-wide reporting offices would remain permissible. Legal entities with 250+ employees have to set up their own internal reporting office in any case.

• Relevant disclosures: The material scope takes up the areas of law specified by the EU Directive, extended to corresponding national law. In particular, this includes national criminal law and the national law governing administrative offences.

• Legal consequences: Provided that the whistleblower could rightfully assume that the information disclosed was true, they are extensively protected against any reprisals and detriments, such as dismissals. Here, also, contrary to the EU Directive, the reprisals are not set out - the draft act provides protection against any act or omission connected with the professional activity where it is a response to a whistleblowing report. In case of reprisals or detriments, it is for the employer to prove these were not related to the whistleblowing, but were based on other, sufficiently justified reasons. If the employer fails to prove this, there is an obligation to compensate the whistleblower for the disadvantage resulting from the unfavourable treatment.

• Reporting:
  • Public authorities, like the Federal Financial Supervisory Authority (BaFin) for the financial market sector to act as external reporting authority and country level oversight for specific violations (eg against provisions of the Securities Acquisition and Takeover Act or violation of the rights of shareholders of public limited companies).
  • Internal and external reporting channels shall be provided, constituting two equal reporting channels that can be freely chosen by the whistleblower.
  • There shall be no obligation for reporting authorities to process/track anonymous reports. According to the EU Directive, this decision was left to the Member States.
• Confidentiality: Implementing the requirements of the EU Directive and in compliance with the case law of the ECHR, the identity of the whistleblower must not be disclosed without explicit consent to anyone beyond those dealing with the report. Furthermore whistleblowers who disclose information to the public are only protected if there was no timely response on external reporting, reasonable expectation of imminent risk to public interests and otherwise ineffective external reporting. Anonymous reports do not have to be investigated, but “should” be. Companies obliged under the Whistleblower Protection Act do not have to enable anonymous whistleblowing.
• Prescribed timeframe: Prescribed timeframe: Deadlines to be observed by employers when receiving whistleblower complaints in accordance with the EU Directive:
  • 7-day deadline for confirmation of receipt;
  • 3-month deadline for response on measures/reasons.

  In comparison with the HinSchG draft from December 2022, the newly adopted law provides for the following changes:

  • Generally, the changes have a limited impact. In particular, the obligation to introduce an internal reporting system remain unchanged.

  • The HinSchG now provides that external and internal reporting offices are no longer obliged to enable and process anonymous reports. Anonymous reports “shall” be investigated, but there is no obligation to do so. Irrespective of this, however, companies are still well advised to allow anonymous reports and to follow up on them. Based on our experience, allowing anonymous reporting contributes to employees’ trust in a whistleblowing system. Furthermore, it gives the company the opportunity to identify serious grievances, which are often initially reported anonymously, and thus reduce or avoid risks to the business.

  • The HinSchG still allows the setting up of a central reporting office at a group company, where group companies employ less than 250 employees. According to the HinSchG, group companies employing more than 249 employees need to set up their own central reporting and investigation office. A group reporting office would not be sufficient in this case.

  • According to the new HinSchG, it should be preferable for whistleblowers to report to an internal reporting office so effective internal action should be taken against the violation. In principle, the choice of reporting channel is left to the whistleblowers themselves, however, companies should be interested in making the use of internal reporting channels attractive and trustworthy. Internal reporting will allow companies to be in a position to take remedial action. The ability to do this is considerably limited in the case of external reporting.

  • The HinSchG continues to provide for a reversal of the burden of proof in favour of whistleblowers with regard to the question of whether a measure taken against the whistleblower constitutes reprisal. This means that in the event of a (legal) dispute, employers must provide that (labour law) market pressures taken against whistleblowers, such as warning or dismissal, are not a reaction to whistleblowing. In contrast to the previous draft, however, the new HinSchG provides that whistleblowers explicitly invoke the disadvantage due to the report.

  • The fine initially envisaged was reduced from a maximum amount of EUR100,000 to EUR50,000. Additionally, the claim for damages for pain and suffering previously provided in the HinSchG draft was removed.

  Further detail on the implementation of this Directive including a Q&A for employers on seeing up an internal reporting office is available here