The purpose of the following Questions & Answers is to explain what we consider to be the most important issues raised by the consultants`draft on the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) and to answer the questions that we are most frequently asked.
Please do not hesitate to contact us directly if you have any further questions concerning the HinSchG.
What is a whistleblowing system?
A whistleblowing system is a system for receiving information about legal or regulatory violations. Whenever a report is received from an internal or external whistleblower about irregular behaviour in a company or a public authority, this constitutes "whistleblowing".
When will it become mandatory to set up a whistleblowing system?
The Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law ("EU Whistleblowing Directive") imposes an obligation for the Member States to transpose the EU Whistleblowing Directive into national law until 17 December 2021.
According to the EU Whistleblowing Directive, the obligation to establish a whistleblowing system applies to
- companies with 250 or more employees
- public authorities with 50 or more employees and
- municipalities with 10,000 or more inhabitants.
By 17 December 2023 at the latest, the the obligation to maintain a whistleblower system will also apply to legal entities with 50 to 249 employees.
The national legislator missed this transposition deadline.
Many provisions of the EU Whistleblowing Directive are unconditional and sufficiently precise. Therefore, according to the prevailing legal opinion, it can be assuemd that these aforementioned provisions directly apply for municipalities and public companies aswell as for legal entities established under private law which are owned or controlled by the public sector. Against this background an obligation to establish and provide for a whistleblowing system already exists for the public sector.
The private sector on the other hand is not directly affected yet. There is merely an indirect impact of the EU Whistleblowing Directive: According to this, the national courts are obliged to conduct an interpretation of the applicable law which is in conformity with the EU Whistleblowing Directive. This applies in particular to rights of defense and claims in the relationship between employees and employers. Therefore, the establishment of a whistleblowing system is also recommended for private companies.
Note:
Due to
- the coalition agreement, which addresses the implementation of the EU Whistleblowing Directive on page 111,
- the statement by the new Federal Minister of Justice, Mr. Buschmann, on a rapid implementation of the EU Whistleblowing Directive and
- the infringement proceedings against Germany already initiated by the EU Commission
an implementation of the EU Whistleblowing Directive can be expected at short notice.
For whom will it become mandatory to set up a whistleblowing system?
This obligation applies to employers and agencies.
Who is covered by the term “employer”?
Within the meaning of the Hinweisgeberschutzgesetz “employers” are, provided that at least one person is employed by them,
- natural persons and legal entities incorporated under private law,
- partnerships having legal capacity, and
- other associations of persons having legal capacity.
Who is covered by the term “agency”?
Within the meaning of the Hinweisgeberschutzgesetz, the term “agencies” refers to the individual authorities, administrative offices and the operational units of corporations, institutions and foundations under public law, as well as the courts.
Who is considered an “employee” within the meaning of the Hinweisgeberschutzgesetz?
In addition to workers, employees also include those who are employed for their vocational training, civil servants, employees covered by collective agreements, judges, soldiers, and persons who, due to their economic dependence, are regarded as similar to workers. These also include those employed in home-based work and their peers.
How is the number of employees determined which is decisive for the obligation to establish an internal reporting office or, as the case may be, a whistleblowing system?
Determining the usual number of employees requires looking back at the previous personnel force in the organisation and estimating the future trend. In other words, the focus should be on the number of people usually employed by the employer. The estimate should not be based on a specific reference date.
Doe the term “company under corporate group law” (konzernrechtliche Unternehmensbegriff) apply in this case?
The Hinweisgeberschutzgesetz does not explicitly address the question of whether companies with less than 50 employees that belong to a corporate group are considered to be employing less than 50 employees, or are regarded as employing more than 50 employees because they are part of a group. For reasons of legal certainty, however, we recommend applying the concept of a “company under corporate group law”, i.e. aggregating all employees of a corporate group for the purposes of deciding whether the Hinweisgeberschutzgesetz and thus the whistleblowing system is applicable or not.
Who can perform the function of an internal reporting office?
An internal reporting office may be staffed by a person employed by the employer or agency, an internal organisational unit or a third party.
Several employers with generally 50 to 249 employees can operate a joint office (a common whistleblowing system) for this purpose or engage a third party to operate a joint office on their behalf.
There are no guidelines as to which persons or organisational units are most suitable for performing this duty. This depends on the organisational structure, size and type of the activities carried out. .
However, an internal reporting system must meet the following requirements:
- Impartiality
- Exclusion of possible conflicts of interest with other duties
- Regular training of the persons designated to perform the duties of an internal reporting office
External third parties may also be engaged to set up and operate the internal reporting office. In particular, it remains possible to engage external lawyers as ombudspersons, who can perform the additional task of operating an internal reporting office.
What are the advantages of staffing the internal reporting office with an external lawyer?
Due to the sensitivity of the information that is handled, it is recommended that the internal reporting office is staffed externally by a lawyer, who is bound to secrecy under professional law.
This also avoids any potential conflicts of interest that could arise in an internal solution.
In addition, a lawyer can make an initial assessment of the information received and make a recommendation as to how to proceed.
To whom must the internal whistleblowing system be accessible?
The reporting channels that are set up must be open at least to the organisation’s own employees. The organisations obliged to set up the system may decide for themselves whether the reporting procedure should also be open to outside persons who are in professional contact with the organisation and who become aware of an infringement within the organisation.
What kind of infringements can a whistleblower report?
This is still a political point of discussion. Under the EU Directive, breaches of European Union law may be reported. Nevertheless, an area that the Directive leaves untouched is the power of Member States to extend protection under national law in relation to areas or acts not covered by the EU Directive.
The consultants`draft of the Hinweisgeberschutzgesetz provides that breaches of German law, in particular any infringement that constitutes a criminal or administrative offence, may also be reported. This extension of the material scope of application to national law is necessary in our view (an opinion shared by the Federal Ministry of Justice and Consumer Protection (BMJV)) in order to achieve an effective whistleblower protection system. This is the only way to avoid glaring gaps in protection and legal imponderables. Otherwise, a whistleblower might need to contact a lawyer in order to find out whether it involves a breach of European or German law.
How can whistleblowers send tip-offs?
Internal reporting channels must allow reports to be made verbally or in text form.
On the request of the whistleblower, a personal meeting with the persons responsible for receiving a report at the internal reporting office shall be facilitated within a reasonable time in the case of a verbal report.
Can I also make a tip-off anonymously?
Under the Hinweisgeberschutzgesetz, external reporting offices are not obliged to process anonymous tip-offs.
Even though the Hinweisgeberschutzgesetz does not explicitly require internal reporting offices to process anonymous tip-offs, it is strongly recommended.
At all events, the protection provisions should also apply to anonymous whistleblowers whose identity becomes known at a later stage.
Is there a requirement to inform the whistleblower about receipt of the report at the internal whistleblowing system?
The whistleblower must receive acknowledgement of receipt of the report at the whistleblowing system within 7 days.
Does the whistleblower have to be informed about follow-up measures in connection with the report to the internal whistleblowing system?
The whistleblower must be informed of proposed follow-up actions and those that have already been taken in connection with the report to the internal whistleblowing system, as well as the reasons for these measures, within three months of the report being received.
Are there other reporting channels available to me, besides the internal reporting office?
Persons intending to report information about a breach are free to choose whether to contact an internal reporting office or an external reporting office.
If an internally reported infringement is not remedied, the whistleblower is also free to contact an external reporting office subsequently.
As an exception, information on infringements may also be made public if
- an external report was initially made and a response was not received within three months regarding appropriate follow-up measures
or
- the whistleblowers had reasonable grounds to believe that
- the infringement could constitute an immediate or obvious threat to the public interest,
- there is a risk of reprisals if an external report is made, or
- due to the particular circumstances of the case, there is little chance that the external reporting office will take effective follow-up action.
What persons do the protection provisions of the Hinweisgeberschutzgesetz apply to?
The protection provisions apply to natural persons who report information on breaches, either through internal or external reporting offices, or disclose such information in line with the requirements of the Hinweisgeberschutzgesetz. This includes all persons who may potentially have gained knowledge of an infringement in a professional setting. Besides employees, this also includes other groups of persons such as the self-employed, volunteers and board-level members of corporate entities.
Natural persons who are the subject of a report and other persons who are affected by a report are also protected.
In what circumstances is the whistleblower protected?
Whistleblowers, who submit information to the whistleblowing system, are protected if
- they have reported internally or externally, or have gone public
- the information is accurate, or the whistleblower had reasonable grounds to believe that, at the time of the report or disclosure, the information that was reported or made public was correct, and
- the information relates to infringements falling within the scope of the Hinweisgeberschutzgesetz
It is also intended to protect a whistleblower who made mistakes in assessing the facts and who reported inaccurate or incorrect information in good faith.
In contrast, persons who abusively or maliciously report false information to the whistleblowing system, are not protected.
How is the whistleblower protected?
Reprisals against whistleblowers are prohibited. This also applies to threats and attempts at reprisals.
“Reprisal” refers to any discrimination that results from a report or disclosure. Examples of discriminatory actions or omissions could include termination of employment, premature termination of a contract for work or a freelance service contract, refusal to allow participation in further training, an employment-related warning, disciplinary actions, harm (including damage to reputation) or causing financial loss.
The burden of proof is reversed under these circumstances in favour of the whistleblower in proceedings before courts or authorities relating to a disadvantage suffered by the whistleblower. If the whistleblower claims to have suffered this disadvantage as a consequence of his report or disclosure, this is generally presumed to be true. Then it is up to the person who took the discriminatory action to prove that this action was based on reasons with sufficient justification, or that it was not due to the report or disclosure.
To whom does the confidentiality requirement apply?
Reporting offices are required to maintain the confidentiality of the following persons’ identity:
- the whistleblower,
- the persons who are the subject of a report, and
- any other persons mentioned in the report.
The identity may only be disclosed to persons responsible for receiving reports or taking follow-up action.
Are penalties to be expected for breach of the Hinweisgeberschutzgesetz?
Penalties are applied to
- anyone who intentionally obstructs a report or the communication following a report between the whistleblower and the reporting office (this includes in particular any intimidation of the whistleblower);
- anyone who takes or threatens reprisals;
- anyone who infringes the confidentiality requirement either intentionally or negligently.
Even attempts to obstruct reporting or to take reprisals are subject to penalties.
The range of fines is
- up to EUR 100,000 for obstructing reports or taking reprisals,
- up to EUR 20,000 for breach of the duty to maintain confidentiality.