Hinweisgeberschutzgesetz: Germany Transposes The EU Whistleblowing Directive

On 16 December 2022, the Bundestag passed a government draft for the Hinweisgeberschutzgesetz or Whistleblower Protection Act.
Moritz Homann
Chapters

In July 2022, Germany’s Federal Cabinet passed a government draft for the Hinweisgeberschutzgesetz or Whistleblower Protection Act. On 16 December 2022, the new law was passed in the Bundestag. Late 2022 saw a surge in EU Whistleblowing Directive transpositions across Europe with Belgium, Greece and Italy all adopting measures just before Berlin passed its law. As a next step, the legislation will enter the Bundesrat and it could come into force in March 2023.

Illustration two persons talking about a German whistleblowing law

What is Germany's Whistleblower Protection Act?

The Whistleblower Protection Act is Germany’s implementation of the EU Whistleblowing Directive, which aims to establish standardised protection for whistleblowers across the EU for the first time.

The law regulates the protection of natural persons who have obtained information about violations in the course of their professional activities and pass it on to internal or external reporting bodies (whistleblowers). This includes employees, civil servants, self-employed persons, partners, interns, volunteers, employees of suppliers as well as persons whose employment relationship has already ended or has not yet begun and is in a pre-contractual stage. 

The Whistleblower Protection Act prohibits any reprisals or retaliation against whistleblowers. 

EU member states had until 17 December 2021 to transpose the Directive into their national laws. Such a law is overdue and up until now whistleblowers have been provided with insufficient protection from reprisals or negative consequences. In Germany, there was a first push towards whistleblower protection in 2019 with the “Gesetz zum Schutz von Geschäftsgeheimnissen” or “Act on the Protection of Business Secrets”.

We are pleased that whistleblowers in Germany now finally have legal certainty when they report wrongdoing or criminal offences in the company, not just in the case of violations of EU law but also in the case of criminal offences such as corruption or tax evasion. This comprehensive protection is an important step towards more integrity in business”, stated Achim Weick, founder and CEO of EQS Group. 

Whistleblower Protection Act: the timeline

End of 2020:  The then Minister of Justice Christine Lambrecht (SPD) submits a first draft for coordination in the ministries.

April 2021: Minister Lambrecht’s draft bill is overturned by CDU/CSU and the grand coalition under CDU and SPD fails to reach an agreement for the national implementation of the Directive.

November 2021: In their coalition agreement, the three traffic light parties – SPD, Greens and FDP, agree to implement the EU Whistleblowing Directive “in a legally secure and practicable manner” while clearly positioning themselves as being in favour of whistleblower protection. They also intend to go beyond the minimum requirements of the European Union Directive 2019/1937 and extend the scope of application to national law. The coalition agreement is a concrete indication of the planned implementation period. 

December 2021:  The deadline for transposing the Directive passes on 17 December 2021 without a German law.

February 2022:  The EU Commission initiates infringement proceedings against several EU countries, including Germany, for failing to transpose the Directive within the specified timeline. 

April 2022: Justice Minister Dr. Marco Buschmann has a draft bill prepared by his ministry and it is sent to other ministries for review on 5 April. The content of the second draft is based on the first draft of former Minister of Justice Christine Lambrecht (SPD) from the end of 2020.

July 2022: The Federal Government passes a draft bill

September 2022: The Bundesrat issues a statement on the proposed legislation and the Federal Government intends to submit its counterstatement at a later point. The bill is discussed in a first reading on 29 September 2022. 

December 2022: On 16 December, the law was passed in the second and third reading in during the last session of the Bundestag. A bill amended by the Legal Affairs Committee was presented to MPs for discussion. 

As the next step, the law must now pass through the Bundesrat and it is expected to come into force in March 2023. 

On 14 December, the bill had already passed the legal committee with a coalition majority against the votes of the CDU/CSU and AfD, with Die Linke abstaining. 

 

What do companies need to know now in order to be prepared for the Whistleblower Protection Act?

1) There will be two mandatory reporting channels: internal and external

2) Companies should develop incentives for the use of internal reporting channels

Whistleblowers are free to decide whether they want to make internal reports or submit information externally. However, the law stipulates that internal reporting channels should be used as a matter of priority. 

Companies should therefore create incentives so that whistleblowers prefer to use internal reporting channels without hindering the submission of reports to external reporting bodies. For example, companies should provide clear and easily accessible information on the use of the internal reporting procedure. 

In particular, external reporting bodies should also inform the whistleblower about the possibility of making an internal report. 

If a whistleblower’s tips remain unacknowledged or if the person concerned sees sufficient reason for a “threat to the public interest”, they would then fall under the protection of the Act when going public (via the press, media or social media). 

“Around 90% of all whistleblowers first try to address observed grievances internally before turning to the authorities, media or public – provided they find suitable channels and an open company culture”. 

– FISCHER, EVA (2019): EU COMMISSION AND EUROPEAN PARLIAMENT CLASH OVER WHISTLEBLOWER PROTECTION

3) The scope of application should cover infringements of European AND national law

The draft extends the material scope of application to violations of national law and thus goes beyond the minimum requirements of the EU Whistleblowing Directive. The prerequisite here is that the offences must be a criminal or administrative and endanger health/life. 

The German legislator wants to avoid “value contradictions” with the extension, because in reality, the restriction of whistleblowing for violations of exclusively European law could cause uncertainty among whistleblowers. They could then refrain from reporting for fear that their report would not be covered by the law. 

Whistleblowers could then draw attention to violations such as corruption or tax evasion. The Digital Markets Act of the European Union is now also to be included in the material scope of the law.

4) Processing anonymous tips is obligatory

The law obliges reporting channels to process anonymous tips and to take precautions to enable anonymous communication with the whistleblower(s). In the previous draft, only a recommendation was made in this regard

Marcus Sultzer, member of the board of directors of EQS Group, very much welcomes this improvement:

“Research shows that many whistleblowers choose to report anonymously because they have a high level of uncertainty about the process and its consequences. The Whistleblowing Report 2021 showed that 73.2% of whistleblowers choose to remain anonymous when this option is available. Many organisations have long recognised the benefits of anonymous reporting channels and use them to increase the number of valuable reports.  

Here, the federal government has taken a clear step forward compared to the last draft. We see this as very positive, because many whistleblowers fear repression if they reveal their identity. It would also be a great danger for companies if certain reports no longer reach them”.

5) Shared systems and outsourcing

For organisations with between 50 and 249 employees, the law provides for the sharing of whistleblowing systems. Similarly, companies/groups, regardless of their size, are allowed to use joint reporting channels. Here, the parent company can assume the role of the third party supervising the reporting system. Furthermore, it is possible to outsource the reporting channel to an institution outside the company such as an ombudsperson. 

 

6) Reversal of the burden of proof in favour of the whistleblower and damages after reprisals

As required by the Directive, the law aims to prohibit possible reprisals against whistleblowers and to invoke the reversal of the burden of proof. The employer must therefore prove that there is no link whatsoever between an employee’s dismissal and whistleblowing. However, if the whistleblower suffers reprisals, he or she can assert a claim for damages. This will apply to both employees and civil servants.  

7) Exceptions for classified information

The Whistleblower Protection Act does not cover information that is classified, and information that falls under the medical/lawyer’s duty of confidentiality or judicial secrecy.

However, an exception applies to the lowest level of secrecy “VS-Nur für den Dienstgebrauch” (classified information for official use only), as long as it concerns violations that are subject to punishment and are reported via an internal channel. This exception does not apply if a third party – pursuant to Section 14(1) – is entrusted with the internal reporting channel.  

8) Sanctions and claims for damages

In case of non-compliance with the legal requirements, the law provides for sanctions against natural and legal persons. 

Violations are to be punished as administrative offences under section § 30 OWiG with a fine. This includes, for example, obstructing reports or taking reprisals but also for knowingly disclosing incorrect information. 

In the event of a violation of the prohibition of reprisals, the person providing the information must be compensated for the resulting damage. Persons who pass on false information – intentionally or through gross negligence – must pay for the resulting damage. 

 

What does whistleblower protection mean?

Whistleblower protection means that persons (whistleblowers) who uncover illegal wrongdoing by reporting it, and supporting society as a result, are shielded from reprisals by law. For example, the cashier in the supermarket who notices that the store manager is relabelling spoiled food and the accountant who discovers that the CEO is financing his private trips through the company account are probably asking themselves the same question: Should they report the wrongdoing and endanger their future as a result? This is because whistleblowers have not had it easy in the past. Not only do they have to fear for their job, but they often fail to find a new one.

Whistleblowers do not enjoy comprehensive protection, even though they often take great professional and private risks to inform society about abuses. The stigmatisation of the “informer” is still too widespread, even though it takes a lot of courage to disclose grievances.

This is exactly where the new law wants to have an impact:

Whistleblowers should be protected in the future from reprisals such as dismissal, warning, denial of promotion, change of assignment, damage to reputation, disciplinary measures, discrimination or bullying. In the event that whistleblowers suffer financial damages due to retaliation, they have the right to compensation. 

What have been the biggest points of contention so far regarding the Whistleblower Protection Act?

In the first draft, the CDU/CSU disliked the SPD’s move to extend the law beyond the EU’s requirements to take German law into account and it accused its former coalition partner of imposing an additional burden on German companies during the pandemic. The CDU/CSU therefore demanded that the law be limited to the requirements of the EU Whistleblowing Directive. 

The SPD countered that in this case whistleblowers could report data protection violations and would be protected. However, if a whistleblower disclosed extensive fraud – as in the Wirecard case – he or she would in no way be protected from reprisals under EU law. The same would apply to violations of German criminal offences such as corruption, tax evasion or bribery payments.

The CDU/CSU parliamentary group also expressed scepticism about the second draft and already announced that it was “anything but approvable”. For example, it lacked incentives for whistleblowers to first seek internal clarification of the facts.

Criticism of the Whistleblower Protection Act

Early drafts of the law were also met with criticism from other quarters. 

NGO Transparency International Deutschland in particular saw a great need for improvement in some aspects, especially in terms of dealing with reports without clear names. This has now been amended in the latest draft as whistleblowing channels are also obliged to process anonymous reports. 

Annegret Falter, chair of the Whistleblower Network, welcomed the draft as a great step forward but saw some gaps in protection for whistleblowers, especially in the area of classified information. According to the draft, the law only protects reports “if they relate to the lowest level of secrecy, concern criminal offences and are kept absolutely internal by the authorities”. 

Our tips for companies

After EU GDPR and the Lieferkettensorgfaltspflichtengesetz (Supply Chain Due Diligence Act), the Whistleblower Protection Act is the next compliance regulation where there is a broad spectrum of impacted organisations. 

 

1.) Do not wait too long for the law to come into force 

Companies should set up professional compliance structures in good time to encourage whistleblowers to report through internal channels. Practice shows that a whistleblowing system is particularly successful when it is embedded in a trustworthy and transparent corporate culture. 

2.) Information and communication are the be-all and end-all

The better the channels are communicated and can be found on a company’s website or intranet, the more employees will be aware of them and access them when needed. All relevant information about the law must therefore be made available to employees. 

In our White Paper “Whistleblower Protection for Businesses“, you can find many inspiring examples of successful communication of whistleblowing systems in companies and the public sector.  

3.) Best Practice: Digital Whistleblowing System 

The professional use of digital whistleblowing systems in companies and the public sector can prevent or solve many crimes and scandals at an early stage. It is telling that more and more organisations are introducing digital whistleblowing systems for internal and external reporting, a trend that is expected to continue due to the new legal landscape in Europe. 

If a whistleblowing system is already in place within a compliance management system, companies should adapt it to the requirements of the Directive or relevant national law so that they comply and legal uncertainties can be avoided.

4.) Effective whistleblower protection is possible for SMEs without high costs

Cost-effective solutions for medium-sized and small companies are readily available. Often, a digital system will be bundled with an external ombudsperson, usually a lawyer from a neutral law firm. 

Guide to the Introduction of Whistleblowing Systems

How to successfully implement a whistleblowing system in your organisation.

Share this blog post on

Share on linkedin
Share on xing
Share on twitter
Share on facebook
Moritz Homann contact image | integrityline.com
Moritz Homann
Managing Director Corporate Compliance | EQS Group
Moritz Homann is responsible for the department of Corporate Compliance products at EQS Group. In this function, he oversees the strategic development of digital workflow solutions tailored to meet the needs of Compliance Officers around the world.