Germany introduces new Whistleblower Protection Act

With the 2019 Whistleblower Protection Directive, the EU aims to improve the protection of whistleblowers in all member states. The Whistleblower Protection Act ("Hinweisgeberschutzgesetz – HinSchG") is intended to implement the directive in Germany, but goes beyond the requirements of the directive, as it protects not only the reporting of violations of defined EU law but also reports of violations of German criminal and administrative offences law. The law is intended to make it possible for whistleblowers in companies and public authorities to point out abuses and violations of the law. To this end, internal and external (state) reporting offices must be established. In addition, whistleblowers are to be protected against reprisals due to reports made in good faith.

After a version of the law passed by the Bundestag did not receive the necessary approval by the Bundesrat on 10 February, the mediation committee of the Bundestag and Bundesrat was called upon to reach an agreement. In addition, the European Commission has taken Germany to the Court of Justice of the EU (CJEU) for failing to transpose the directive on time.

After long negotiations between Bundestag and Bundesrat members, an agreement on the new law was finally reached and the law was passed both by the Bundestag and the Bundesrat on 11 and 12 May 2023. The new law is expected to enter into force at the end of June.

"The final amendments by the mediation committee are small and will have limited practical impact," Eike W. Grunert, compliance expert at Pinsent Masons, said. "However, the time after which the act will come into force after its publication was shortened from three to one months. This has an impact for business with more than 249 employees, as they now have less time for implementation. Apart from this, the scope of the law remains unchanged, as it continues to go beyond the requirements of the EU directive: the Whistleblower Protection Act protects whistleblowers who report violations of EU legal acts as well as those who report criminal offences and certain administrative offences under German law, insofar as the provisions serve to protect life, limb, health, rights of employees or their representative bodies."

Compared to the version originally adopted by the Bundestag, the final version provides for further small adjustments. External and internal reporting offices are no longer obliged to set up their reporting channels in such a way that anonymous reports are possible. Nevertheless, anonymous reports "should" be processed, but internal and external reporting offices are no longer obliged to do so.

"Businesses are still well advised to carefully follow up on anonymous reports and to design their reporting channels accordingly, even if this is no longer mandatory under the Act," Grunert said. "Experience shows that particularly serious grievances are initially reported anonymously. This should also apply to the state-run external hotlines."

According to the now passed version of the law, whistleblowers should report to an internal reporting office in the first instance if "effective internal action can be taken against the violation" and there is no fear of retaliation.

Grunert is cautious about the practical relevance of this change: "It is questionable whether whistleblowers will now prefer to turn to the internal reporting office only because they expect that the company will take effective internal action against the violation and that they will not have to fear retaliation. Experience shows that whistleblowers are usually particularly loyal employees who first denounce wrongdoings internally anyway so that the company can take remedial action. However, this change creates further incentives for businesses to make the internal whistleblowing system 'attractive' for their employees, including easy accessibility and operation. In addition, businesses should communicate positively internally and make it clear to employees that whistleblowers will be taken seriously, that whistleblowing will be followed up, that remedial action will be taken and that whistleblowers do not have to fear retaliation."

In addition, the maximum fine in cases where reports are obstructed or retaliation is made is now €50,000 instead of €100,000. The right to compensation for pain and suffering for whistleblowers was removed.

The law still provides for a reversal of the burden of proof in the case of legal disputes about whether a whistleblower has been subjected to retaliation. This means that in the event of a dispute, the company must prove that it did not discriminate against the whistleblower because of their report. This rule is to remain, but only if the whistleblower explicitly claims to have suffered a disadvantage because of their report.

"Due to the statutory reversal of the burden of proof in favour of the whistleblower, there is an increased litigation risk for companies in any legal disputes with whistleblowers," said Sarah Klachin, employment law expert at Pinsent Masons. "The reversal of the burden of proof creates a certain risk of abuse, which makes it even more necessary for companies to accurately document their employment law actions towards whistleblowers."

Klachin also pointed out that from a collective labour law perspective, various enforceable co-determination rights of works councils come into consideration. "Companies with a works council should therefore promptly get together with their works council and involve it in the implementation of the Whistleblower Protection Act. This can best be done via the conclusion of a shop agreement,"  Klachin said.

Failure to set up a reporting office can only be punished with a fine six months after entry into force. For smaller companies which usually have between 50 and 249 employees, the obligation to set up an internal reporting office is subject to a transitional period until 17 December 2023. Companies which usually have fewer than 50 employees are not covered by the requirement to establish an internal reporting office.

Download:Guide Whistleblower Protection Act (2 pages / 149KB PDF)