Whistleblower Protection Act: What companies must do

Which companies are concerned?

The Whist­leb­lo­wer Pro­tec­tion Act pre­scri­bes the im­ple­men­ta­tion of a whist­leb­lo­wer sys­tem. This ge­ne­rally af­fects all pri­vate and pu­blic law com­pa­nies with re­gu­larly at least 50 em­ployees.

© iStock

Sec­tion 12 (3) of the HinSchG (Whist­leb­lo­wer Pro­tec­tion Act) man­da­tes the ob­li­ga­tion for cer­tain com­pa­nies re­gard­less of their num­ber of em­ployees. This par­ti­cu­larly af­fects com­pa­nies in the fi­nan­cial ser­vices sec­tor.

Relief for medium-sized companies...

Cer­tain re­li­efs exist only for me­dium-si­zed com­pa­nies with a work­force of 50 to 249 em­ployees. These com­pa­nies may es­ta­blish and ope­rate a joint of­fice for re­cei­ving re­ports and for fur­ther mea­su­res, ac­cor­ding to Sec­tion 14 (2) HinSchG. Howe­ver, they re­main in­di­vi­dually ob­li­ga­ted to re­medy the vio­la­tion and to pro­vide feed­back to the whist­leb­lo­wer.

…and group companies

For group com­pa­nies, there is re­lief in­so­far as an in­de­pen­dent and con­fi­den­tial of­fice as a "third party" can be es­ta­blis­hed at ano­ther group com­pany, which can also be ac­tive for se­veral in­de­pen­dent com­pa­nies wi­thin the group.

In­ter­nal re­ports must also be pos­si­ble in the working lan­guage pre­vai­ling in the re­spec­tive com­mis­sio­ning sub­si­di­ary. The ap­point­ment of a cen­tral re­por­ting of­fice at a group com­pany must not create ad­di­tio­nal bar­riers for whist­leb­lo­wers.

What types of whistleblowing systems are possible?

Sec­tion 7 of the HinSchG (Whist­leb­lo­wer Pro­tec­tion Act) es­sen­ti­ally pro­vi­des for two equally va­lid re­por­ting chan­nels for whist­leb­lo­wers – an in­ter­nal and an ex­ter­nal re­por­ting chan­nel. It is le­gally pre­scri­bed that the whist­leb­lo­wer should pre­fer re­por­ting to an in­ter­nal re­por­ting chan­nel in ca­ses where the vio­la­tion can be ef­fec­tively ad­dres­sed in­ter­nally and they do not fear re­pri­sals, ac­cor­ding to Sec­tion 7 (1) sen­tence 2 HinSchG.

In­ter­nal re­por­ting chan­nels

There is fle­xi­bi­lity in the pre­cise de­sign of the com­pany-in­ter­nal re­por­ting chan­nel. The in­ter­nal re­por­ting of­fice can be es­ta­blis­hed by:

• an in­di­vi­dual em­ployed by the re­spec­tive em­ployer,
• a work unit con­sis­ting of se­veral em­ployed per­sons, or
• a third party

being ent­rus­ted with the tasks of the in­ter­nal re­por­ting of­fice. This me­ans that, also a la­wyer can act as an ex­ter­nal om­buds­per­son to take on the tasks of the in­ter­nal re­por­ting chan­nel. In any case, the per­son con­cer­ned needs suf­fi­ci­ent com­pe­ten­cies to be able to carry out the ne­cessary le­gal as­sess­ment of the re­ports.

The tasks of the in­ter­nal re­por­ting of­fice in­clude ope­ra­ting the re­por­ting chan­nels, con­duc­ting the le­gally pre­scri­bed pro­ce­dure for in­ter­nal re­ports (Sec­tion 17 HinSchG), and ta­king ap­pro­priate fol­low-up mea­su­res.

The re­por­ting chan­nels must be de­si­gned in such a way that re­ports can be made in writ­ten or oral form.

When a whist­leb­lo­wer re­port is re­cei­ved by the com­pany, the con­fi­den­tia­lity of the iden­tity of the whist­leb­lo­wer, the per­sons who are the sub­ject of the re­port, and other per­sons men­tio­ned in the re­port must be main­tai­ned, ac­cor­ding to Sec­tion 8 HinSchG.

Ex­cep­ti­ons to this con­fi­den­tia­lity re­qui­re­ment exist only in very li­mited ca­ses, ac­cor­ding to Sec­tion 9 HinSchG.

Note: An ob­li­ga­tion to es­ta­blish re­por­ting of­fices that also al­low an­ony­mous re­por­ting, which was en­vi­sa­ged du­ring the le­gis­la­tive pro­cess, no lon­ger exists ac­cor­ding to the now-enac­ted law. Sec­tion 16 (1) sen­tence 4 HinSchG me­rely pro­vi­des that the in­ter­nal re­por­ting of­fice should also pro­cess an­ony­mously re­cei­ved re­ports. Com­pa­nies are free to enable an­ony­mous con­tact and an­ony­mous com­mu­ni­ca­tion bet­ween the whist­leb­lo­wer and the in­ter­nal re­por­ting of­fice. This ap­plies in par­ti­cu­lar for those who have al­re­ady es­ta­blis­hed such chan­nels.

Par­ti­cu­larly sui­ta­ble as whist­leb­lo­wer sys­tem is the es­ta­blish­ment of an elec­tro­nic re­por­ting op­tion. Howe­ver, upon the whist­leb­lo­wer's re­quest, a phy­si­cal mee­ting must also be made pos­si­ble wi­thin a re­ason­able ti­me­frame, ac­cor­ding to Sec­tion 16 (3) HinSchG.

Note: The pos­si­bi­lity for whist­leb­lo­wers to have a per­so­nal con­ver­sa­tion is par­ti­cu­larly im­port­ant when ent­rus­ting a third party with the tasks of an in­ter­nal re­por­ting of­fice. With the cons­ent of the whist­leb­lo­wer, howe­ver, the mee­ting can also take place via vi­deo and au­dio trans­mis­sion, ac­cor­ding to Sec­tion 16 (3) HinSchG.

The in­ter­nal re­por­ting chan­nel must be open to at least the em­ployees and tem­porary workers of the com­pany. Volun­ta­rily, the whist­leb­lo­wer sys­tem can also be made ac­ces­si­ble to those who get into con­tact with the re­spec­tive com­pany wi­thin scope oft­heir pro­fes­sio­nal ac­tivity. This in­clu­des, for ex­am­ple, com­pany of­fi­cers and share­hol­ders, ap­pli­cants, self-em­ployed in­di­vi­du­als, or for­mer em­ployees.

Ex­ter­nal re­por­ting chan­nels

In ad­di­tion to es­ta­blis­hing an in­ter­nal re­por­ting sys­tem, com­pa­nies must also pro­vide their em­ployees, as po­ten­tial whist­leb­lo­wers, with un­der­stan­da­ble and ea­sily ac­ces­si­ble in­for­ma­tion about the pos­si­bi­li­ties of ex­ter­nal re­por­ting to cer­tain aut­ho­ri­ties.

Note: For ex­ter­nal re­por­ting of­fices, too, they should pro­cess an­ony­mous re­ports, but they do not have to es­ta­blish a cor­re­spon­ding chan­nel for this pur­pose, ac­cor­ding to Sec­tion 27 (1) HinSchG.

At the same time, Sec­tion 24 (2) HinSchG sees a task of the ex­ter­nal re­por­ting of­fices in in­for­ming about the pos­si­bi­lity of an in­ter­nal re­port.

The whist­leb­lo­wer can ba­si­cally de­cide whe­ther to re­port vio­la­ti­ons in­ter­nally to the com­pany or to con­tact an ex­ter­nal aut­ho­rity. Howe­ver, as sta­ted above, in­ter­nal re­por­ting of­fices should be pre­fer­red, ac­cor­ding to Sec­tion 7 (1) HinSchG.

Ac­cor­ding to Sec­tion 7 (3) HinSchG, em­ploy­ers should create in­cen­ti­ves for whist­leb­lo­wers to con­tact the re­spec­tive in­ter­nal re­por­ting of­fice be­fore re­por­ting to an ex­ter­nal re­por­ting of­fice and pro­vide clear and ea­sily ac­ces­si­ble in­for­ma­tion to em­ployees about the use of the in­ter­nal re­por­ting pro­ce­dure. At the same time, they are ob­li­ged to in­form about ex­ter­nal re­por­ting pro­ce­du­res ac­cor­ding to Sec­tion 13 (2) HinSchG.

Which whistleblower reports are protected?

The Whist­leb­lo­wer Pro­tec­tion Act ex­tends its scope beyond the re­qui­re­ments of the EU- Di­rec­tive. Whist­leb­lo­wers are pro­tec­ted when re­por­ting vio­la­ti­ons that are pu­nis­hable by cri­mi­nal law or (with some re­stric­tions) by fi­nes, ac­cor­ding to Sec­tion 2 (1) No. 1 and 2 HinSchG. The re­port must con­tain in­for­ma­tion about vio­la­ti­ons in the em­ployer’s com­pany where the whist­leb­lo­wer is or was ac­tive, or at ano­ther en­tity with which the whist­leb­lo­wer is or was in con­tact due to his pro­fes­sio­nal ac­tivity, ac­cor­ding to Sec­tion 3 (3) HinSchG.

Fur­ther­more, the sub­stan­tive scope of ap­pli­ca­tion ex­tends to other vio­la­ti­ons of fe­deral and state le­gal pro­vi­si­ons as well as di­rectly ap­plica­ble le­gal acts of the EU and the Eu­ro­pean Ato­mic En­ergy Com­mu­nity, ac­cor­ding to Sec­tion 2 (1) No. 3 to 10, (2) HinSchG. This in­clu­des, among others, the fol­lo­wing areas:

• com­ba­ting mo­ney laun­de­ring and ter­ro­rist fi­nan­cing,
• pro­duct safety and con­for­mity,
• traf­fic safety in­clu­ding rail­way safety, ma­ri­time traf­fic, and air traf­fic safety,
• en­viron­men­tal pro­tec­tion,
• ra­dia­tion pro­tec­tion and nu­clear safety,
• food and feed safety, ani­mal health and wel­fare,
• pu­blic health,
• con­su­mer pro­tec­tion,
• pro­tec­tion of pri­vacy and per­so­nal data as well as the se­cu­rity of net­work and in­for­ma­tion sys­tems,
• cer­tain vio­la­ti­ons of the Act Against Res­traints of Com­pe­ti­tion (GWB).

Implementation of the Whistleblower Protection Act in the company

Com­pa­nies are well ad­vi­sed to en­sure in­ter­nal pro­ces­ses in the event of an in­ter­nal re­port. These should be set out in a whist­leb­lo­wer po­licy, pos­si­bly also in a Code of Con­duct, and com­mu­ni­ca­ted ac­cor­din­gly. Em­ployees should be en­cou­ra­ged to re­port pri­ma­rily to the in­ter­nal re­por­ting of­fice to avoid po­ten­tial da­mage to their re­pu­ta­tion.

Ap­point­ment of Con­tact Per­sons

In­de­pen­dent (com­pli­ance) con­tact per­sons must be ap­poin­ted for in­ter­nal re­ports. Both in­ter­nal em­ployees and ex­ter­nal third par­ties are eli­gi­ble. If com­pa­nies ope­rate the in­ter­nal re­por­ting of­fice with their own em­ployees, the staf­fing of the re­por­ting of­fice must be en­su­red, and the re­le­vant per­son­nel must be trai­ned, es­pe­cially in com­pli­ance. The re­spon­si­ble em­ployees must be able to le­gally check whe­ther the no­ti­fi­ca­tion is re­por­ta­ble ac­cor­ding to the HinSchG and meet the high re­qui­re­ments for the con­fi­den­tial hand­ling of the re­port.

Note: Em­ploy­ers should do­cu­ment cor­re­spon­ding qua­li­fi­ca­ti­ons and be able to pro­vide them if ne­cessary. It is also im­port­ant to en­sure the in­de­pen­dence of the re­spon­si­ble em­ployees and to be able to ex­clude con­flicts of in­te­rest. If com­pa­nies or­ga­nize the in­ter­nal re­por­ting of­fice th­rough ex­ter­nal om­buds­per­sons, such as la­wy­ers, they can rely on their qua­li­fi­ca­ti­ons.

In­vol­ve­ment of the Works Coun­cil

If a works coun­cil exists in the com­pany, it should be in­vol­ved early and ap­pro­pria­tely in the im­ple­men­ta­tion of a whist­leb­lo­wer sys­tem. Spe­ci­fi­cally, the works coun­cil must be in­for­med in ad­vance about the plan­ned es­ta­blish­ment of a whist­leb­lo­wer sys­tem, ac­cor­ding to Sec­tion 80 (2) Be­trVG (Works Con­sti­tu­tion Act). Its im­ple­men­ta­tion can re­lease a right of co-de­ter­mi­na­tion from Sec­tion 87 (1) No. 1 Be­trVG, ac­cor­ding to which the works coun­cil has to be in­clu­ded in mat­ters of the or­ga­niza­tion of the com­pany and the be­ha­vior of em­ployees in the com­pany.

Alt­hough there is no co-de­ter­mi­na­tion right of the works coun­cil re­gar­ding the de­ci­sion on "whe­ther," i.e., whe­ther an in­ter­nal re­por­ting of­fice is to be es­ta­blis­hed, gi­ven the exis­ting le­gal ob­li­ga­tion, there are de­sign op­ti­ons re­gar­ding the spe­ci­fic de­sign of the whist­leb­lo­wer sys­tem or the ap­point­ment of the in­ter­nal em­ployees ope­ra­ting the in­ter­nal re­por­ting of­fice, in which the works coun­cil must be in­vol­ved, ac­cor­ding to Sec­tion 99 Be­trVG.

Ac­cor­din­gly, the de­ci­sion on whe­ther the com­pany sets up the in­ter­nal re­por­ting of­fice wi­thin the com­pany its­elf or with an ex­ter­nal third party is not sub­ject to co-de­ter­mi­na­tion.

The fur­ther pro­ce­dure re­gar­ding the pro­ces­sing of re­cei­ved no­ti­fi­ca­ti­ons also of­fers scope for the co-de­ter­mi­na­tion rights of the works coun­cil.

Fi­nally, the works coun­cils must be pro­perly in­vol­ved in any trai­ning mea­su­res that be­come ne­cessary due to the es­ta­blish­ment and ope­ra­tion of an in­ter­nal re­por­ting of­fice, ac­cor­ding to Sec­tions 96 ff. Be­trVG.

Com­pli­ance with Le­gal Re­qui­re­ments for Pro­ces­sing In­ter­nal Re­ports

The pro­cess af­ter re­cei­ving a no­ti­fi­ca­tion is le­gally pre­scri­bed. It is ad­visa­ble to create a writ­ten ac­tion plan to main­tain feed­back dead­lines and con­fi­den­tia­lity. The fol­lo­wing steps must be ob­ser­ved:

• The whist­leb­lo­wer must re­ceive con­fir­ma­tion of re­ce­ipt of the re­port wi­thin se­ven days.
• The re­cei­ved no­ti­fi­ca­tion must then be che­cked by the in­ter­nal re­por­ting of­fice.
• In­com­ing re­ports must be do­cu­men­ted, ac­cor­ding to Sec­tion 11 HinSchG. If ne­cessary, the do­cu­men­ta­tion should be pre­sen­ted to the whist­leb­lo­wer for ve­ri­fi­ca­tion.
• Ap­pro­priate fol­low-up mea­su­res must be ta­ken, ac­cor­ding to Sec­tion 18 HinSchG.

Note: For the con­duct of in­ter­nal in­ves­ti­ga­ti­ons – while main­tai­ning con­fi­den­tia­lity – in­for­ma­tion can also be pas­sed on to work units wi­thin the com­pany, ac­cor­ding to Sec­tion 18 No. 4 HinSchG.

• The in­ter­nal re­por­ting of­fice must pro­vide feed­back to the whist­leb­lo­wer wi­thin th­ree months af­ter con­fir­ming re­ce­ipt of the re­port. The feed­back in­clu­des no­ti­fi­ca­tion of plan­ned and al­re­ady ta­ken fol­low-up mea­su­res as well as the re­asons for them.

Note: The ex­tent to which em­ploy­ers should create in­cen­ti­ves to use in­ter­nal re­por­ting pro­ce­du­res first is not spe­ci­fied by the law. Since the whist­leb­lo­wer should pre­fer in­ter­nal re­por­ting chan­nels if no re­ta­lia­tion is to be fea­red and it is ex­pec­ted that ef­fec­tive ac­tion will be ta­ken against the vio­la­tion, this can be seen as an ex­pli­cit ap­peal by the le­gis­la­tor for cor­re­spon­ding pro­fes­sio­nal in­ter­nal struc­tures. Only if whist­leb­lo­wers can trust that com­pa­nies take no­ti­fi­ca­ti­ons se­riously, in­ves­ti­gate them care­fully, and cla­rify cri­mes or ir­re­gu­la­ri­ties as well as sanc­tion them ap­pro­pria­tely, will they pre­fer these in­ter­nal re­por­ting struc­tures as in­ten­ded.

Re­por­ting and No­ti­fi­ca­tion Ob­li­ga­ti­ons of the Em­ployer?

To ef­fec­tively pu­nish or re­medy vio­la­ti­ons and to act in com­pli­ance with the law, em­ploy­ers must ob­serve any re­por­ting and no­ti­fi­ca­tion ob­li­ga­ti­ons in other laws.

With cer­tain ex­cep­ti­ons (Sec­tion 138 of the Ger­man Cri­mi­nal Code), cri­mi­nal of­fen­ses are ge­ne­rally not sub­ject to man­datory re­por­ting. Howe­ver, in the case of tax law vio­la­ti­ons, there may be an im­me­diate ob­li­ga­tion to cor­rect the tax de­cla­ra­tion ac­cor­ding to Sec­tion 153 of the Ger­man Fis­cal Code (AO), the vio­la­tion of which can lead to cri­mi­nal lia­bi­lity for tax eva­sion. Fur­ther re­por­ting ob­li­ga­ti­ons may arise from the Mo­ney Laun­de­ring Act.

In some ca­ses, proac­tive con­tact with in­ves­ti­ga­tive aut­ho­ri­ties may be ad­visa­ble to re­duce the risk of ti­mely al­ter­na­tive know­ledge by the aut­ho­ri­ties, such as th­rough ex­ter­nal re­por­ting of­fices. This can also serve to avert im­pen­ding coer­cive mea­su­res and to li­mit the risk of one's cri­mi­nal lia­bi­lity, pos­si­bly due to omis­sion.

Fur­ther­more, a func­tio­ning com­pli­ance sys­tem re­qui­res a clear com­mit­ment to la­wful be­ha­vior, which in turn can be en­su­red by filing a cri­mi­nal com­plaint. If the filing of a cri­mi­nal com­plaint is con­side­red, the th­ree-month ap­pli­ca­tion pe­riod for so-cal­led ap­pli­ca­tion of­fen­ses must be ob­ser­ved.

Protection for the whistleblower

Whist­leb­lo­wers are only le­gally pro­tec­ted if there was a ju­sti­fied re­ason to be­lieve that the re­por­ted in­for­ma­tion about vio­la­ti­ons was true at the time of the re­port, fell wi­thin the scope of the law, and was sub­mit­ted via the pre­scri­bed in­ter­nal or ex­ter­nal re­por­ting chan­nels.

In this case, the HinSchG then pro­hi­bits any re­pri­sals against whist­leb­lo­wers, ac­cor­ding to Sec­tions 33ff. HinSchG. Thus, whist­leb­lo­wers must not fear any la­bor law con­se­quen­ces for a pro­per re­port: for ex­am­ple, they must not be sub­ject to dis­mis­sal, non-con­side­ra­tion for a pro­mo­tion op­por­tu­nity, trans­fer, or de­nial or re­duc­tion of a bo­nus. To ef­fec­tively de­sign this pro­hi­bi­tion of re­ta­lia­tion, whist­leb­lo­wers can rely on a re­ver­sal of the bur­den of proof, ac­cor­ding to Sec­tion 36 (2) HinSchG. Ac­cor­din­gly, the exis­tence of re­ta­lia­tion is le­gally pre­su­med, and the em­ployer must re­fute this pres­ump­tion. In the event of a vio­la­tion of the pro­hi­bi­tion of re­ta­lia­tion, there is a claim for da­ma­ges for fi­nan­cial los­ses of the whist­leb­lo­wer.

Note: In this con­text, com­pa­nies should do­cu­ment the foun­da­ti­ons and mo­ti­ves of per­son­nel de­ci­si­ons well.

For vio­la­ti­ons of the HinSchG, sanc­tions with sub­stan­tial fi­nes bet­ween 10,000 and 50,000 eu­ros are pro­vi­ded, ac­cor­ding to Sec­tion 40 HinSchG. Fi­nes for not es­ta­blis­hing a cor­re­spon­ding in­ter­nal re­por­ting of­fice will only be im­po­sed af­ter a tran­si­tion pe­riod of six months from the ap­plica­bi­lity of the re­gu­la­ti­ons.

The fi­nes can af­fect both the re­spon­si­ble in­di­vi­du­als and (via Sec­tion 30 of the Ger­man Re­gu­latory Of­fen­ses Act) the re­spec­tive com­pa­nies. For cer­tain vio­la­ti­ons, the fine against the com­pany can also in­crease ten­fold, ac­cor­ding to Sec­tion 40 (6) sen­tence 2 HinSchG.

Conclusion

Com­pa­nies with 50 or more em­ployees must im­ple­ment a whist­leb­lo­wer sys­tem and com­ply with the le­gal re­qui­re­ments re­gar­ding the ne­cessary pro­ces­ses and re­cor­ding ob­li­ga­ti­ons.

To avoid po­ten­tial da­mage to re­pu­ta­tion, com­pa­nies should trans­pa­rently de­sign the in­ter­nal re­por­ting chan­nel in their own in­te­rest, and em­ployees should be fully in­for­med about the use of this in­ter­nal whist­leb­lo­wer sys­tem. In ad­di­tion, a com­pany-in­ter­nal whist­leb­lo­wer po­licy should be im­ple­men­ted or em­bed­ded in a Code of Con­duct.