After some political wrangling, the German Bundesrat approved the so-called “Whistleblower Protection Act” on May 12, 2023 (here, in German), thus clearing the way for the implementation of the corresponding EU directive. The practical need for such a law is obvious, not only in view of the events at the Berlin-Brandenburg broadcasting service RBB (see here for more details). However, it is not only larger companies that are likely to be under increased pressure to implement the law, as it is expected to come into force in mid-June and only very short implementation periods are envisaged. This is reason enough to supplement the previous explanations (see here) by highlighting some of the important points of the upcoming law, particularly for small and medium-sized enterprises.
The legislative process
After a lengthy legislative process (see on the procedure up to 2022, here, in German), in a first vote in February 2023 the Bundesrat (upper house of the German parliament) refused to approve the „Gesetz für einen besseren Schutz hinweisgebender Personen sowie zur Umsetzung der Richtlinie zum Schutz von Personen, die Verstöße gegen das Unionsrecht melden“ (“Act for Better Protection of Whistleblowers and for the Implementation of the Directive on the Protection of Persons Reporting Violations of Union Law,”) the full name of the HinSchG, because in the view of at least the Union-led German States, the proposed law implemented the EU Whistleblower Directive “excessively” with regard to the scope of application and the possibility of submitting anonymous reports (see here for more details, in German). Finally, the Mediation Committee of both houses drafted the version that has now been passed by the Bundesrat (here, in German).
Key points of the HinSchG
Pursuant to § 12 HinSchG, “employers” (see below) with more than 249 employees are immediately and, as of December 17, 2023, also companies with more than 50 employees are then obliged to introduce a whistleblower procedure (so-called “internal reporting point”), whereby companies with between 50 and 249 employees may operate a “joint reporting point” pursuant to § 14 (2) HinSchG. Pursuant to § 13 (3) HinSchG, certain companies (such as those in the financial and insurance sectors) must even set up an internal reporting point regardless of the number of employees.
Pursuant to § 3 (9) HinSchG, “employers” in the sense of this law are generally all private and public corporations as well as partnerships with legal capacity and non-legal capacity, provided that at least one person is employed by them. Thus, for example, state broadcasting corporations or churches and religious communities are also covered by this law. Pursuant to § 1 HinSchG, in addition to the “whistleblower” (natural person), persons who are the “subject” of a report or disclosure, as well as other persons who are “affected” by a report or disclosure, are also to be protected. In addition, under certain circumstances, § 34 HinSchG also protects such natural persons who confidentially assist the whistleblower in an internal or external report or disclosure in a professional context. The core of whistleblower protection is defined in §§ 35 to 37 HinSchG. Accordingly, whistleblowers cannot be held responsible (§ 35 HinSchG) and a ban on reprisals exists against them under § 36 (1) HinSchG, which is reinforced by a reversal of the burden of proof under § 36 (2) HinSchG. In the event of reprisals nevertheless carried out against whistleblowers, a claim for damages is possible under § 37 HinSchG and there is also the possibility of imposing fines under § 40 HinSchG, whereby the Mediation Committee reduced the maximum amount from EUR 100,00 to EUR 50,000. Conversely, under § 38 HinSchG, whistleblowers are obligated to compensate for damages resulting from an intentional or grossly negligent report or disclosure of inaccurate information.
The provision of § 2 HinSchG defines the material scope of application of the law, i.e., what is meant by a “notice”. This is either the reporting (§ 3 (4) HinSchG) or the disclosure (§ 3 (5) HinSchG) of information, for example, on violations subject to criminal penalties or fines (see the list for more details). The Mediation Committee narrowed the scope of the Act to the extent that the information must relate to the employer or another body with which the person providing the information was in professional contact (see § 3 (3) HinSchG new). The provision of § 5 HinSchG then constitutes some exceptions to the scope of application, for example, if a report concerns Germany’s national security, the judicial secrecy of advice or the obligations to maintain confidentiality in the case of lawyers or doctors. Finally, § 6 HinSchG specifies the handling of information that concerns the area of the “Act on the Protection of Business Secrets” (GeschGehG, see already here). Although § 5 HinSchG also regulates the relationship of the HinSchG to other regulations, such as the GWG, there is likely to be some overlap with the German Supply Chain Act (LkSchG, see here).
§ 12 et seq. HinSchG regulate the details of the establishment and operation of so-called “internal hotlines”. These can also be operated by external third parties (with the necessary expertise). The obligated employers must ensure that corresponding reports can be submitted by telephone or in writing and are then forwarded for further processing without delay. According to the Mediation Committee’s version of the HinSchG, both internal and external reporting offices should “also process anonymous incoming reports. However, there is no obligation to design the reporting channels in such a way that they allow anonymous reports to be submitted.” (cf. § 16 (1) sentences 4 to 6 / § 27 (1) sentences 3 to 6 HinSchG new). According to §§ 19 ff. HinSchG, the federal government establishes and operates an office for external reports at the Federal Office of Justice (external federal reporting office); the German States are required to establish their own reporting offices. Pursuant to § 7 HinSchG, whistleblowers are in principle free to choose whether to contact an internal or external reporting office, although the Mediation Committee achieved a certain preference for internal reporting offices by inserting an additional sentence in § 7 (1) HinSchG, according to which whistleblowers should “prefer to report to an internal reporting office in cases where effective action can be taken against the violation internally and they do not fear reprisals.“
Conclusion: With the entry into force of the HinschG, Germany has fulfilled its obligation to implement the corresponding EU directive rather belatedly. Looking at the changes made by the Mediation Committee, however, one cannot help but wonder why implementation has now taken almost one and a half years longer – especially since the previous German government had already done a great deal of preparatory work.
However, it is to be hoped that the delay has been used by the companies concerned to set the basics for the establishment of a reporting system. This also against the background that, although there was already a certain “market” with third-party providers for designing, setting up and operating an “external internal” reporting system, this market is now likely to experience bottlenecks, at least temporarily, as a result of the Act coming into force. In addition, the establishment of hotlines is generally considered to be subject to co-determination, i.e., the works council must be involved.
Finally, those responsible for “employment providers” with a workforce of less than 50 should bear in mind that their employees could also turn to external hotlines – which could possibly lead to unpleasant findings. It may therefore also be advisable for smaller companies to make use of a service provider as an internal reporting point would be advantageous.
Only in a few years will it be possible to evaluate any positive consequences of the now incoming Act – as well as the potential evasive movements of the affected employers. It will also be necessary to take a close look at whether the protection of whistleblowers has actually been improved by the HinSchG – in other words, whether it has been REALLY wrapped up. However, it is already clear now that the Act will create additional bureaucracy for companies – the already established data protection, money laundering and human rights officers will probably be joined by the whistleblower officer. Let’s hope that the effort and the return will be in proportion to each other.
Note: At the time of publication of this article, the HinSchG has not yet been published in the Federal Law Gazette; after publication, the link to the text of the law will be published as a supplement and the individual standards mentioned above will be linked directly for better clarity.