As per our previous blog post, very few members of the European Union managed to implement the provisions of the Whistleblowing Directive into their national legislation before the 17 December 2021 deadline for compliance. Germany is one of the countries that failed to meet the deadline, but as in a number of other EU countries, progress is now being made in relation to this.

In mid-April this year, the Federal Ministry of Justice published a draft bill – the Whistleblower Protection Act (Hinweisgeberschutzgesetz / HinSchG) – which should be in place by the Autumn. Its aim is to expand the protection for whistleblowers, which is currently considered insufficient by both EU and German legislators.

Key provisions

The key provisions of the draft bill are:

• The HinSchG obliges all companies with at least 50 employees to establish internal reporting channels for disclosures of wrongdoing. Some sectors will be required to have them irrespective of the number of employees, e.g. financial institutions and insurance companies.  The HinSchG does not prescribe the form of the internal reporting channel in detail. Instead, how it should be designed depends on the organisational structure and the size and type of activity of the respective company, allowing for some level of proportionality in the process. However, the person performing the task of receiving and investigating disclosures must in all cases be able to act independently. To that end, it should be possible under the draft bill to outsource the management of internal reporting channels to third parties such as lawyers or auditors. The German legislator has stated that, in the context of corporate groups, the parent company or a subsidiary can be considered a third party for these purposes. However, as the European Commission recently stated that the outsourcing of the internal reporting channel to a central group is not compliant with the requirements of the Whistleblowing Directive, it is likely that this provision will either be knocked out before the legislation is passed or challenged afterwards.

• The HinSchG stipulates that in addition to these internal reporting channels, an external reporting channel must also be established by the federal authorities. Thus, a separate unit is to be created at the Federal Office of Justice (Bundesamt für Justiz), which is responsible for the receipt and processing of reports from whistleblowers. It will serve as a central contact point for whistleblowers, check the validity of whistleblower’s reports as a first step and then initiate further follow-up measures with the employer.

• Protection under the legislation will be extended to anyone who obtains information about legal violations in the course of their professional activities and reports these via the internal or external reporting channels provided for under the HinSchG. It therefore goes much further than just employees – also to self-employed freelancers, employees of suppliers, employee representatives, candidates, members of executive bodies, external trainers, etc. Companies will therefore have to ensure that internal reporting channels are properly designed to accommodate third parties and anonymous reporting. They should also ensure that they are clearly and transparently advertised so employees and third parties are encouraged to prefer internal reporting channels (at least initially) to reporting directly to the authorities. Furthermore, the protection granted under the HinSchG will include individuals who are the subject of a report as well as other individuals named in a report (e.g. witnesses).

• The scope of the Whistleblowing Directive has been extended by the German legislator to include reports with regard to all kinds of criminal offences under the HinSchG and reports concerning certain administrative offences.

• The whistleblower does not have to report clear evidence of a possible breach to gain protection under the legislation. It is sufficient that they present reasonable grounds for suspicion and have sufficient reason to believe (at the time of the report) that the information reported is true.

• Whistleblowers whose reports fall within the scope of the HinSchG will be protected against any kind of reprisal such as dismissal, warnings, non-renewal of a fixed-term contract, relocation to another department, etc. Any measures taken against an individual which are based on a protected report would be invalid (warning, demotion, dismissal, etc.) and would also entitle the whistleblower to claim damages.

Next steps

• The current timetable intends enactment by Autumn 2022 at the latest.

• With regard to the obligation to maintain an internal reporting channel, the HinSchG will allow medium-sized companies (50 to 249 employees) until December 2023 to do this, whereas larger companies will be subject to the new regulations as soon as the legislation enters into force.