Today, the German Federal Council (Bundesrat) approved the act on the implementation of the Whistleblower Directive (“German Whistleblower Protection Act” – HinSchG), after several delays and convocation of the mediation committee. From the time the act is promulgated in the Federal Law Gazette, companies with 50 or more employees will be required to set up certain whistleblower systems within a specified period. The act will come into force one month after promulgation – expectedly in mid June 2023.

IN DEPTH

1. BACKGROUND

The aim of the German Whistleblower Protection Act (HinSchG) is to implement the so-called EU Whistleblower Directive (EU) 2019/1937 of October 23, 2019, for improved whistleblower protection and to create legal certainty when reporting or disclosing potential wrongdoing in companies and public authorities. The act regulates the protection of so-called “whistleblowers”, i.e. natural persons who have obtained information about violations throughout their professional activities and carry this information to designated reporting channels. In addition to persons who report breaches of Union law, the HinSchG also protects whistleblowers who report violations of national law.

2. WHO IS AFFECTED BY THE ACT?

In principle, whistleblower systems must be set up by legal entities in the private sector with at least 50 workers. All enterprises having up to 250 employees will be obliged to have implemented the requirements of the Whistleblower Protection Act by December 17, 2023, at the latest. Companies with more than 250 employees will be left with just one month from the promulgation of the HinSchG to implement it. The same applies to highly regulated companies pursuant to Section 12 para. 3 HinSchG, regardless of its number of employees, such as capital management companies or insurance companies. For listed companies, A.2 of the German Corporate Governance Code provides for a recommendation to set up a whistleblower system, which applies independently of the size or number of workers of the company.

3. OBLIGATIONS AND CONSEQUENCES FOR THE COMPANIES

Companies are required to establish and operate internal reporting channels for whistleblowers and to provide access to external reporting channels. Internal reporting channels which the workers can turn to, will be set up and operated by the employer itself. The employer is supposed to create incentives for employees to turn to the internally established channel as a preference in order to achieve fast processing and internal resolution of internal problems while also relieving the external channels.

At the same time, whistleblowers are encouraged to turn to the internal reporting channel if this is likely to be successful and there is no threat of retaliation. However, whistleblowers have the choice of using an internal reporting channel or reporting their information to an external channel – possibly also out of fear of a lack of anonymity. The HinSchG does not provide for any legal consequences for prioritizing the external reporting channel in a manner that deviates from the legislative intent.

External reporting channels are competent authorities that are authorized to receive reports. Such an external reporting channel is set up, for example, at the Federal Office of Justice or by the federal states in the respective state and local administrations. Internal and external reporting channel structures have in common that they are not required to set up anonymous reporting channels. However, anonymous reports must still be taken into account and processed.

The HinSchGt also prohibits companies from retaliation against whistleblowers. Even the threat or attempt to impose sanctions is prohibited. This applies towards suspension, dismissal, salary reduction, non-renewal of a fixedterm employment contract and any intimidation attempts on the part of the employer towards its employees. The HinSchG provides for an employee-protective reversal of the burden of proof, which in practice will not play a major role, at least in the main case of termination, due to the existing allocation of the burden of proof under the German Dismissal Protection Act (Kündigungsschutzgesetz). Only in case of terminations outside the scope of the German Dismissal Protection Act may this reversal of the burden of proof bring a relevant change. Pursuant to Section 36 para. 2 of the HinSchG, it is presumed that an occupational disadvantage following a report or disclosure constitutes retaliation. However, the reversal of the burden of proof only occurs if the person providing the information sets out the possible connection. In the event of a violation by the company, the whistleblower shall be entitled to compensation of the resulting damage.

If an employer who falls under the HinSchG does not set up an internal reporting channel, fails to operate it properly or takes retaliation, it commits an administrative offense. Violations of this kind can be punished under the HinSchG with a fine of up to EUR 50,000.00.

4. RECOMMENDATION TO COMPANIES

In order to avoid possible sanctions, the companies to which the HinSchG applies should now, at the latest, endeavor to establish appropriate reporting channels within the timeframe set by the German legislator. Particular attention should be paid to the fact that the HinSchG will enter into force earlier than envisaged in the previous draft. The HinSchG enters into force one month after promulgation – in mid-June 2023. Sanctions for employers who have not set up an internal reporting channel may only be imposed after the transitional period of six months, but even before this point in time there is a risk that whistleblowers may immediately turn to external reporting channels.