The EU Whistleblowing Directive - Watch out: The German Whistleblower Protection Act is in the starting blocks

For the uniform establishment of whistleblower protection, the European Union issued the so-called Whistleblowing Directive (EU) 2019/1937 in the fall of 2019, i.e. a directive for the protection of persons who report violations of Union law. This came into force on December 16, 2019 and must be implemented in German law by December 17, 2021 at the latest. If the draft of the HinSchG, which has been available for this purpose since recently, were implemented, this would result in the obligation for many companies to develop internal whistleblower systems. For various reasons, it is advisable to tackle this "task" at an early stage. Companies would also do well to design their whistleblower system in a well thought-out manner that is attractive to whistleblowers. Otherwise, there may be serious consequences for the company's success. 

In a nutshell: The Whistleblowing Directive

Under the Whistleblowing Directive, companies with more than 50 employees as well as public authorities and municipalities with more than 10,000 inhabitants are required to establish systems/channels through which violations of EU law can be reported. In doing so, the directive provides for various channels – without mandatory adherence to a specific sequence: an internal report, a report to the competent authority and a report to the public. Whistleblowers are to be better protected from negative consequences (so-called prohibition of reprisals) and violations of EU law prevented by this directive or its national implementation.

The scope of application of the HinSchG

In line with the EU Directive, the draft HinSchG provides for a broad personal scope of application. In addition to employees, it also covers civil servants (including judges and soldiers), but also members of executive bodies (board members, managing directors), trainees and persons similar to employees. Also included in the scope of application are employees of suppliers and persons who have already gained knowledge of violations before the start of an employment relationship. Also protected are natural persons who assist whistleblowers in making a report or disclosure and whose assistance is intended to be confidential.

In accordance with the EU Directive, the obligation to set up internal whistleblowing units applies to employers with 50 or more employees and to municipalities with 10,000 or more inhabitants. For companies with up to 249 employees, however, the (speaker's) draft contains a grace period: For these companies, the obligation to set up a whistleblowing system shall only apply after December 17, 2023. 

In order to avoid inconsistencies and create legal certainty for potential whistleblowers, the draft covers not only violations of EU law, but also violations of German regulations corresponding to the EU law mentioned in the directive, such as German environmental law. In addition, the entire German criminal law and law of administrative offenses is covered, which means that an enormous number of possible violations can be reported. This extension is not mandatory. Rather, the German legislator is making use of the possibility provided by the Directive to extend the scope to include violations of national law.  

Right of choice: internal and external reporting offices

The HinSchG distinguishes between internal and external reporting offices.

For internal reporting offices, it defines certain minimum requirements (such as documentation obligations, deadlines for feedback to the whistleblower, etc.). In addition, the hotline must be run by trained personnel and the decision on how to deal with a whistleblower must be made independently. The draft law explicitly provides for persons employed by the company to act as the reporting office, but external third parties, such as a lawyer, can also be appointed as ombudspersons. Reports can be made verbally (e.g. by telephone) or in text form; anonymous tips do not have to be followed up. The reporting office must treat the identity of both the whistleblower and the persons otherwise affected by the report as confidential.  

In addition to the internal whistleblower system, the draft also provides for external reporting offices to be set up by the federal government or the states, in line with the EU Directive. 

Companies that do not comply with the obligation to set up/maintain a whistleblower system will not face any direct sanctions. Nevertheless, it can be of decisive importance for companies to establish an internal whistleblower system and to make it attractive. The background to this is the right of whistleblowers to choose freely between internal and external reporting offices. They are thus free to report any information they receive directly to an external body, i.e. the competent authority. It is precisely this right of choice, or the possible risks to the success of the company that may result from it, that should encourage companies to set up internal whistleblowing systems and make them that attractive that whistleblowers (want to) use them wherever possible and do not pass on their information to the competent authority, which may involve the prosecution authorities.  

Going public is conceived as an absolute exception and is permissible, for example, if the whistleblower has not received any feedback on a report to the external reporting office.

Protection through reversal of the burden of proof

Whistleblowers are comprehensively protected from reprisals such as dismissal, disciplinary measures, denial of promotion, etc. by a so-called reversal of the burden of proof. Accordingly, the employer must demonstrate and prove that a corresponding measure is not due to and/or related to the submission of a whistleblower. Measures that violate the prohibition of reprisals are null and void due to violation of a statutory prohibition (§ 134 BGB). In addition, companies are liable for damages in the event of violations of the prohibition of discrimination.

The protection does not apply to persons who improperly or maliciously report false information. Such a whistleblower is rather liable to the company for damages.