Whistleblower Protection Act Update – Resolution of the German Federal Council (Bundesrat)

1. BACKGROUND
The aim of the German Whistleblower Protection Act (HinSchG) is to implement the so-called EU Whistleblower Directive (EU) 2019/1937 of October 23, 2019, for improved whistleblower protection and to create legal certainty when reporting or disclosing potential wrongdoing in companies and public authorities. The act regulates the protection of so-called “whistleblowers”, i.e. natural persons who have obtained information about violations throughout their professional activities and carry this information to designated reporting channels. In addition to persons who report breaches of Union law, the HinSchG also protects whistleblowers who report violations of national law.

2. WHO IS AFFECTED BY THE ACT?
In principle, whistleblower systems must be set up by legal entities in the private sector with at least 50 workers. All enterprises having up to 250 employees will be obliged to have implemented the requirements of the Whistleblower Protection Act by December 17, 2023, at the latest. Companies with more than 250 employees will be left with just one month from the promulgation of the HinSchG to implement it. The same applies to highly regulated companies pursuant to Section 12 para. 3 HinSchG, regardless of its number of employees, such as capital management companies or insurance companies. For listed companies, A.2 of the German Corporate Governance Code provides for a recommendation to set up a whistleblower system, which applies independently of the size or number of workers of the company.

3. OBLIGATIONS AND CONSEQUENCES FOR THE COMPANIES
Companies are required to establish and operate internal reporting channels for whistleblowers and to provide access to external reporting channels. Internal reporting channels which the workers can turn to, will be set up and operated by the employer itself or a third party entrusted by the employer (e.g., a law firm), see Section 14 para. 1 HinSchG. In an international group, “third party” may also be another group company. In this case, it must be ensured that that the implementation of a central reporting channel at a company of the group does not lead to any obstacles to access in comparison with a set-up of the channel directly in the same company. For example, it must be possible to report in the working language of the entrusting company. In case of entrusting a third party with the tasks of an internal reporting channel, the obligation to take appropriate measures to remedy any violations remains with the entrusting company, see Section 14 para. 1 sent. 2 HinSchG.

The employer is supposed to create incentives for employees to turn to the internally established channel as a preference in order to achieve fast processing and internal resolution of internal problems while also relieving the external channels.

At the same time, whistleblowers are encouraged to turn to the internal reporting channel if this is likely to be successful and there is no threat of retaliation. However, whistleblowers have the choice of using an internal reporting channel or reporting their information to an external channel – possibly also out of fear of a lack of anonymity. The HinSchG does not provide for any legal consequences for prioritizing the external reporting channel in a manner that deviates from the legislative intent.

External reporting channels are competent authorities that are authorized to receive reports. Such an external reporting channel is set up, for example, at the Federal Office of Justice or by the federal states in the respective state and local administrations. Internal and external reporting channel structures have in common that they are not required to set up anonymous reporting channels. However, anonymous reports must still be taken into account and processed.

The HinSchGt also prohibits companies from retaliation against whistleblowers. Even the threat or attempt to impose sanctions is prohibited. This applies towards suspension, dismissal, salary reduction, non-renewal of a fixedterm employment contract and any intimidation attempts on the part of the employer towards its employees. The HinSchG provides for an employee-protective reversal of the burden of proof, which in practice will not play a major role, at least in the main case of termination, due to the existing allocation of the burden of proof under the German Dismissal Protection Act (Kündigungsschutzgesetz). Only in case of terminations outside the scope of the German Dismissal Protection Act may this reversal of the burden of proof bring a relevant change. Pursuant to Section 36 para. 2 of the HinSchG, it is presumed that an occupational disadvantage following a report or disclosure constitutes retaliation. However, the reversal of the burden of proof only occurs if the person providing the information sets out the possible connection. In the event of a violation by the company, the whistleblower shall be entitled to compensation of the resulting damage.

If an employer who falls under the HinSchG does not set up an internal reporting channel, fails to operate it properly or takes retaliation, it commits an administrative offense. Violations of this kind can be punished under the HinSchG with a fine of up to EUR 50,000.00.

4. RECOMMENDATION TO COMPANIES
In order to avoid possible sanctions, the companies to which the HinSchG applies should now, at the latest, endeavor to establish appropriate reporting channels within the timeframe set by the German legislator.

Particular attention should be paid to the fact that the HinSchG will enter into force earlier than envisaged in the previous draft. The HinSchG enters into force one month after promulgation – in mid-June 2023.

In particular, international groups of companies and corporations should review the structure of its whistleblowing system, the arrangement and set-up of the individual reporting channel(s) as well as the related documentation against the background of the current legal developments. If group companies exist in different EU Member States, the differences in the implementation of the EU Whistleblower Directive in the respective Member States must be taken into account. We will, of course, be pleased to support you in the legal review and the implementation of technical solutions in compliance with the applicable best practice standards.

Sanctions for employers who have not set up an internal reporting channel may only be imposed after the transitional period of six months, but even before this point in time there is a risk that whistleblowers may immediately turn to external reporting channels.