The German parliament has adopted the Law for a Better Protection of Whistleblowers (Hinweisgeberschutzgesetz, the “Law”), officially implementing the EU Whistleblower Directive ((EU) 2019/1937; the “Directive”). The Law is expected to enter into force shortly. See our prior Compliance Concourse posting on the then-draft law here.
The Law is the first comprehensive regulation of whistleblowing and whistleblower rights in Germany and exceeds the requirements of the Directive in several respects. It encourages individuals to report illegal conduct in their professional environment while aiming to effectively protect such whistleblowers from adverse consequences.
After going through a conciliation proceeding between the two chambers of the German parliament, the Law was stripped of a few features that were deemed too much of a bureaucratic burden on smaller and medium-sized companies. The key provisions of the Law are as follows:
- The protections afforded by the Law apply to the employees of the respective company, its shareholders, self-employed workers and employees of suppliers.
- The Law includes protections for whistleblowers reporting on breaches of German law and European law in certain areas (including anti-money laundering, product and road safety, consumer and environmental protection, etc.) that they became aware of in the context of their employment or professional work. In addition, the Law offers protections for reporting on criminal offenses (without limitation as to the type of crime) and on a broad set of administrative offences. In this respect, the Law exceeds the minimum requirements of the Directive.
- Companies with 50 or more employees must set up “internal reporting offices” that
whistleblowers can turn to in strict confidence. The internal reporting office may either consist of one or more individuals employed by the company, or a third party commissioned for this purpose. Companies with 50 to 249 employees may establish a joint internal reporting office together with other companies in the same size category. These companies do not need to set up internal reporting offices before December 17, 2023 (with the exception of certain companies in the financial sector). Companies with 250 or more employees need to do so as soon as the Law comes into effect. It is possible to designate a central internal reporting office within a group of companies (e.g., at the parent company for all subsidiaries). - There is no duty to receive and investigate anonymous reports. Companies may nevertheless choose to do so.
- The federal government, the German States and certain agencies are called upon to establish so called “external reporting offices” for whistleblowers wishing to contact someone outside of their organizations.
- Whistleblowers shall primarily report to either the internal or external reporting offices. While they are free to decide between these options, they are encouraged to use internal reporting channels if the matter can be handled effectively internally and no repercussions are feared. Whistleblowers who disclose information to the public are protected by the Law only in exceptional circumstances, e.g., in a case where they made a report to an external reporting office but no timely action was taken or in a case where the whistleblower was acting under the legitimate assumption that the breach he or she is disclosing is generating a risk of irreversible harm or endangerment of the public.
- Whistleblowers cannot be legally pursued for obtaining the information they report unless they obtained the information by committing a criminal offense. Likewise, a whistleblower is not liable for violating a confidentiality obligation (e.g., arising from an NDA) if the whistleblower legitimately believed that he or she had to disclose the information to report a breach.
- Whistleblowing reports must be documented and kept for two years. The documents need to be retained for longer if other laws require this.
- Violations of the Law can result in administrative fines of up to EUR 50,000. These are in addition to potential civil law damages.
- Whistleblowers who made a report to an internal or external reporting office or legitimately disclosed information to the public are protected from repressive measures against them as a result of such reporting. The prohibition of repressive measures is not limited to the whistleblower’s employer but extends to anyone. If the whistleblower claims disadvantages as a result of repressive measures taken in connection with the whistleblower’s professional activity, the burden is upon the persons or entity imposing such measures to prove that the measures are not based on the reporting, but on other duly justified grounds (this represents a reversal of the burden of proof). Whistleblowers are entitled to compensatory damages in a case where the persons or entity that imposed the measures cannot show that they acted for legitimate reasons. The Law does not provide compensation for non-material damages.
The implementation of the Law will likely lead to an uptick in reporting. For companies in scope of the Law, it is thus important not only to review their current whistleblowing rules and procedures to ensure compliance with the requirements of the Law, but also ensure to have in place a process on how to deal with a potentially increased number of whistleblowing reports. Your Willkie Team is happy to provide you with further information and advice on these issues.
Click here to download this article.
