Businesses 'should set up reporting channels despite failed German whistleblower protection law'

With the Whistleblower Protection Directive from 2019, the EU wanted to improve the protection of whistleblowers in all member states European Council adopts EU-wide whistleblower protection rules. The so-called Whistleblower Protection Act was supposed to implement the Directive in Germany, but did not receive the necessary approval by the Bundesrat in a 10 February ruling. Now, the European Commission has taken Germany to the CJEU for failing to implement the directive on time.

The Whistleblower Protection Directive should have been implemented in all member states by 17 December 2021, but the project fell behind schedule during Angela Merkel’s time in office due to disagreements between the two governing parties. In January 2022 the Commission initiated infringement proceedings against Germany. The action before the CJEU is the next step. In the event of defeat, the EU can fine Germany.

"The action against Germany and seven other EU member states for failure to implement the EU Whistleblower Directive was to be expected and consistent," Dr Eike W. Grunert, compliance expert at Pinsent Masons, said. "On the merits, it is hard to understand why German lawmakers have put this important issue on the back burner since the directive was adopted in 2019. The recent refusal of the federal states led by the Christian Democrats to give their consent to the already overdue implementation law in the Bundesrat leads to further delays in the legislative process."

Among other things, the German government and the Bundestag now have the option of calling on the mediation committee to discuss a compromise with the Bundesrat for the law to enter into force in an amended form.

Among other things, the failed Whistleblower Protection Act stipulated that companies and organisations must set up reporting channels through which employees can point out abuses and violations of the law. An external complaints office was also to be set up at Germany’s Federal Office of Justice as an alternative reporting channel. In addition, the law provided that whistleblowers are better protected against dismissal and other retaliation.

The arguments now put forward in the Bundesrat against the law are hardly relevant from a practical business point of view, said Dr Grunert. Among other things, it was criticised that the German law goes beyond the requirements of the EU directive, as the directive only requires reporting channels for violations of EU law, but the draft law also includes violations of certain German laws (including criminal and certain administrative offences).

"The fact that the law failed in the Bundesrat now means that the uncertain legal situation for businesses continues," said Sarah Klachin, an employment law expert at Pinsent Masons. "The situation for businesses is extremely difficult. Many have been thinking and planning how to best implement the requirements for some time. They know that whistleblower protection is coming with the minimum requirements of the directive, however the exact scope remains unclear. Companies still cannot meaningfully plan how exactly to implement whistleblower protection, even if they want to. It would be desirable to have specific requirements in the form of a corresponding law in the near future."

Dr Grunert therefore advises companies to take the initiative in this difficult situation: "Even today and independently of the law, companies are well advised to set up a comprehensive whistleblower protection system. This is often necessary for reasons of company law alone, in order to comply with the management's duty of care," the expert said. In addition, companies should make every effort to protect whistleblowers in good faith and not punish or retaliate against them on the basis of reports.

Dr Grunert also recommends that the reporting channel should cover all conceivable legal violations, and in particular also violations of internal company guidelines, which may be of high importance for the company’s success. A restriction to the - important but in any case very numerous - legal areas relevant under European law according to the EU Whistleblower Directive would hardly make sense in practice and would only be feasible with a rather high additional bureaucratic effort on the part of the company. "Either the whistleblower or the company's internal reporting office or legal advisors would have to make extensive and sometimes complex legal considerations as to whether a certain report falls under the protection of the law or not," Dr Grunert said. "It is much simpler in practice and also more efficient for compliance management purposes if internal reporting channels are open for all legal violations, all reports are followed up with a sense of proportion but also with due diligence in a uniform process, and all bona fide whistleblowers are equally protected from retaliation."

Whether there is also specific protection under the Whistleblower Protection Act would then only have to be examined in exceptional cases if it really mattered, for example if it was disputed whether there had been retaliation.

Dr Grunert said: "Furthermore, it seems questionable to want to protect only those whistleblowers who report grievances relevant under European laws, such as problems with product conformity, energy efficiency, tobacco advertising or data protection, to name just a few relevant issues. Why should the protection not also apply to whistleblowers reporting capital crimes such as murder, manslaughter, rape, human trafficking and slavery, or even simply fraud to the detriment of a non-listed company? And German administrative offences law can also harbour corporate or social explosives with high reputational risks; dismissing these as 'mere infringement of administrative rules' does not seem appropriate."