Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
About the German Whistleblower Protection Act: Hinweisgeberschutzgesetz - HinSchG of May 31, 2023.
In October 2019, the German Whistleblower Protection Act was drafted, a significant step in the workplace by introducing new obligations for the implementation of internal whistleblowing systems in companies. This regulation’s main objective is to ensure that all employees have tools to report possible infractions or irregularities within the organisation, while protecting the confidentiality of the whistleblower.
Although the directive establishes general guidelines for the entire European Union, each country has had to adapt it specifically to the needs of its business sector.
The Whistleblowing Directive in German law, publication and entry into force:
The transposition process in Germany has been slow but steady. Since the submission of the first draft law in December 2020, there had been multiple revisions and clarifications. In fact, the European Commission took Germany to the Court of Justice of the European Union for failing to transpose the EU Whistleblowing Directive on time.
In February of the same year, the draft law was rejected by the Federal Council of the German Parliament, mainly because it was considered an excessive burden on small and medium-sized companies. As a result, a new compromise agreement was needed.
On May 9, 2023, the conciliation committee of the Bundestag and Bundesrat discussed the proposed “Hinweisgeberschutzgesetz” law and reached an agreement. So, days later and with a delay of one and a half years, the whistleblower protection law was finally drafted in Germany on May 31, 2023, although it was not until July 2, 2023 that the German law transposing the European Whistleblowing Directive came into force.
Who is protected by the German Whistleblower Protection Act?
The German Whistleblower Protection Act protects natural persons who, in the course of their professional activities or prior to them, obtain information on infringements and communicate it to the reporting offices designated by this Act (whistleblowers).
In addition, protection is also provided to persons who are the subject of a report or disclosure, as well as to other persons involved in the matter reported by the whistleblower.
Which companies are affected by the German Whistleblower Protection Act?
Employers with 250 or more employees had to implement a whistleblower system immediately after the Act came into force.
Employers with between 50 and 249 employees had an additional period of 6 months to implement the required internal whistleblowing channels, with a deadline set for December 17, 2023.
What violations can be reported?
This Act applies to the reporting and disclosure of information stipulated in its Article 2, including violations punishable by law, violations that are subject to a fine if the rule violated serves to protect life, limb or health or violations of legal provisions that protect the rights of employees or their representative bodies, other violations of federal and state law as well as European law (especially legal provisions that protect the financial interests and the European single market).
However, many companies want to know what might be going wrong in their organisation and encourage their employees to report any wrongdoing. As far as they are legally able to do so, they guarantee their employees a standard of protection in line with the German Whistleblower Protection Act. This is a thoroughly recommendable approach.
How and where can the violations be reported?
Individuals (whistleblowers) wishing to report information about a violation may choose to contact either an internal reporting point or an external reporting office. A company can mandate third parties who have the relevant expertise, in particular lawyers, with the function of an internal reporting point.
A whistleblower should prefer to report to an internal reporting point in cases where the violation can be effectively addressed internally and they do not fear retaliation. If an internally reported violation has not been resolved within a certain period, the person who reported the matter may contact an external reporting office.
In addition, obstructing or attempting to obstruct reports or communication following a report between the whistleblower and the reporting office is prohibited.
What should the reporting channels be like?
As stipulated in Article 16 of the Act, employers obliged to establish internal reporting offices shall establish reporting channels for them through which employees and temporary workers engaged by the employer can communicate with the internal reporting offices to report violations.
The internal reporting channel may be designed in such a way that it is also open to natural persons who, in the course of their professional activities, are in contact with the respective employer who is obliged to establish the internal reporting office or with the respective organisation.
The German Whistleblower Protection Act does not mandate organisations to accept or process anonymous reports. However, it encourages organisations to accept and investigate anonymous whistleblowing reports. Many organisations choose to accept anonymous reports as a best practice, especially if they are committed to fostering a culture of transparency and accountability.
Reporting channels must be set up in such a way that only those responsible for receiving and processing reports and the persons assisting them have access to incoming reports.
Internal reporting channels must enable oral or written reports. However, organisations that really want to know what is going wrong in their ranks are advised to install various reporting channels (verbal, written, digital) to make it as easy as possible for employees to submit a report. Oral reports should be possible to file via telephone or other voice transmission. At the request of the whistleblower, a personal meeting with a person from the internal reporting point responsible for receiving a report should be made possible within a reasonable time to make a report. With the consent of the person providing the information, the meeting may also be conducted by video and audio transmission. In the interests of companies/organisations, every potential whistleblower should be granted the easiest possible access to the internal reporting point, also to prioritise internal reports over external ones This is another reason why it makes sense to entrust an external lawyer with the tasks of the internal reporting point.
What happens once the report has been filed?
The internal reporting point carries out the following procedure:
1. It confirms to the person providing the information the receipt of a report within seven days.
2. It examines whether the reported infringement falls within the scope of application of this Act.
3. The reporting point stays in contact with the person providing the information.
4. It reviews the soundness of the reported matter.
5. If necessary, the reporting point requests further information from the whistleblower.
6. Finally, the internal reporting point, in cooperation with the responsible departments within the company, takes appropriate follow-up measures (c.f. Article 18 of the Act) in accordance with the applicable law.
The internal reporting point will provide feedback to the whistleblower within 3 months after confirmation of receipt of the report or, if receipt has not been confirmed, no later than 3 months and 7 days after receipt of the report.
What are the confidentiality requirements established by the Act?
Reporting points shall maintain the confidentiality of the identity of the following persons:
1.The whistleblower, provided that the information reported relates to violations that fall within the scope of this Act, or the whistleblower had reasonable grounds to believe that this was the case at the time of reporting.
2. The persons who are the subject of a report.
3. Other persons named in the report.
However, Article 9 of the Act lists certain exceptions to these confidentiality requirements. These exceptions apply, for example, in criminal proceedings, at the request of certain authorities and in cases in which the whistleblower has deliberately provided false information.
Who is responsible for evaluating reports?
As stated in Article 12 of the Act, employers must ensure that they have at least one office set up and operated for internal reporting that employees can contact (internal reporting point). This only applies to employers that generally have at least 50 employees, although there are certain exceptions regulated in the same article, concerning especially companies of financial services
If the employer is the federal government or a federal state, the highest federal or state authorities determine the organisational units in the form of single or multiple authorities, administrative bodies, companies or courts.
On the other hand, the persons entrusted with the tasks of an internal reporting point are independent in the performance of their work. In addition to their work for the internal reporting point, they may perform other tasks and duties. The employer must have another contact person available in the event of a conflict of interest, which can never be completely prevented.
Employers shall ensure that the persons responsible for the tasks of an internal reporting point have the necessary expertise.
To whom should external reports be submitted?
The federal government creates an external reporting point in the Federal Office of Justice. The federal external reporting office is organizationally separate from the rest of the Federal Office of Justice’s area of responsibility. Each federal state may set up its own external reporting office for reports concerning the respective state administration and the respective local administrations.
The external reporting office of the federal government shall be provided with the necessary personnel and material resources for the fulfilment of its tasks.
What is the penalty regime and what are the sanctions provided for?
The scope of application of the German Whistleblower Protection Act covers both criminal offences and certain administrative offences, even if a specific criminal offence has not been committed.
However, it does not address compensation for immaterial damages suffered by the whistleblower, an issue of concern for civil society. Serious misconduct that does not reach the threshold of clear legal infringements is also excluded from the scope of application.
Failure to comply with the obligations set out in the Act can lead to fines of up to € 50,000. Further details are regulated in Article 40 of the Whistleblower Protection Act in conjunction with the Administrative Offences Act.
What happens if there is retaliation against the report?
Retaliation directed against persons providing information is prohibited. This also applies to threats and attempts to retaliate. If the prohibition on retaliation is violated, the person responsible is obliged to compensate the person who provided the information for the resulting damage.
To further protect whistleblowers, the German Whistleblower Protection Act regulates a reversal of the burden of proof: Employers will have to prove that the retaliation is not related to whistleblowing.
Frequently asked questions
The law was drafted on 31 May 2023 and came into force on 2 July 2023, one and a half years after the deadline set by the Directive.
Employers with 250 or more employees from the day the Act took effect, and employers with 50 to 249 employees from 17 December 2023, with exceptions for certain financial services companies.
The Act does not oblige organisations to accept or process anonymous reports, but it encourages them to do so, and many organisations accept anonymous reports as best practice.
Receipt must be confirmed within seven days and feedback given within three months. Breaches of the Act can be fined up to 50,000 euros under Article 40, retaliation is prohibited, and the burden of proof is reversed so the employer must show that a measure was unrelated to the report.
Related reading: how to comply with the German whistleblower laws, how the Directive was transposed across the EU, and Trusty whistleblowing software with HinSchG-compliant policies.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.