As early as December 2019, the European Union’s Directive (EU) RL 2019/1937 (colloquially called the “Whistleblower Directive”) was adopted at the European level. This directive aims to strengthen the protection of persons who report possible legal violations committed by companies or authorities. The deadline for implementation of the directive was December 17, 2021. To date, it has not yet taken effect. The Federal Ministry of Justice (Bundesministerium der Justiz), however, on April 13, 2022, published a draft bill for the Whistleblower Protection Act (HinwSchG), which is expected to be adopted in the near future.

External and Internal Reporting Offices

A particularly relevant question from the employer’s point of view, which already arises from the directive itself, is that of the establishment of reporting offices to which whistleblowers can turn if they believe they have identified violations of the law in companies. The directive provides for a two-track model for these reporting offices.

Article 11 of the directive would expressly require the establishment of external reporting channels at the state level. According to the current draft bill, the federal government would establish an external reporting office at the Federal Office of Justice (Bundesamt für Justiz).

The directive would not make it mandatory for companies to establish internal reporting channels. However, the draft bill would require certain employers—depending on the size of the company—to set up internal reporting offices. According to the draft bill, companies with 250 or more employees would have to set up a reporting office immediately, while companies with fifty or more employees would not have to do so until the end of 2023.

Proposed Requirements and Options for Reporting Channels

The requirements for the possible reporting channels envisioned in the draft bill are also significant. For example, the Whistleblower Protection Act would require that employees be permitted to file reports both verbally and in writing. The Whistleblower Protection Act would also require that whistleblowers  be able to contact internal or external bodies at their own discretion. The draft bill does not express any preferred methods of reporting or preferences regarding which internal reporting channels should be used.

In this regard, all companies may want to provide internal reporting channels, even if there is no legal obligation to do so.

According to the draft bill, companies would have various options for setting up internal hotlines. For example, a company would not have to operate its internal reporting office itself; instead, it would be able to commission a third party to operate it.

The bill does not include an obligation to accept anonymous reports, nor does it include a provision that would make it mandatory to accept reports from persons outside the company. Nevertheless, companies may want to open the internal reporting channels to third parties and/or anonymous whistleblowers as well, as this would ensure that these groups also contact the internal reporting office as a matter of priority, if necessary.

Whistleblower Data Protection

It goes without saying that companies may want to pay special attention to data protection when setting up internal hotlines. After all, it is precisely the protection of whistleblowers that is at the heart of the legislation. The Whistleblower Directive would require that a whistleblower’s personal data not be subject to access by any unauthorized third party. In the case of requests for information from data subjects, the directive also would require that the information be protected and not be provided with regard to the data processed within the whistleblower system.

The Whistleblower Directive is now expected to be implemented within a short period of time. We expect the Whistleblower Protection Act to be passed and become effective before the end of 2022.