Whistleblower protection law in Germany is a done deal - With many changes

After many setbacks in the legislative process, the Bundestag and Bundesrat passed the Whistleblower Protection Act (HinSchG) on 11 and 12 May 2023. The implementation of the EU Whistleblower Protection Directive (2019/1937) had already caused controversy within the Grand Coalition. The draft at the time was not pursued further and the deadline for the implementation of the directive could not be met.

With a delay of almost one and a half years, the HinSchG has now been passed by the Bundestag and received the approval of the Bundesrat. The law is expected to come into force in June 2023.

Long overdue implementation of the Whistleblower Directive

This was preceded by a seemingly endless tug-of-war in the legislative process with several changes of course. By 17 December 2021, the EU Directive should have been transposed into German law. However, the government draft passed by the Bundestag on 16 December 2022 (BT-Drs. 20/4909) failed in the Bundesrat on 10 February 2023.

To make matters worse, on 15 February 2023, the EU Commission sued Germany before the European Court of Justice for late implementation of the Whistleblower Directive, demanding a penalty payment of 61,600 euros for each day of delay, or a minimum of 12 million euros in total.

The governing parties then tried to circumvent the penalty payment by reaching into the parliamentary bag of tricks. They divided the previous draft into two parts - a part that did not contain any regulations requiring consent and a part that concerned the aspects of the application of the law to civil servants and authorities that required consent. However, this plan failed because the splitting of the HinSchG into two separate laws prevented the necessary consent of the Bundesrat.

After considerable reservations and resistance, the federal government abandoned the project and called the mediation committee. There, a compromise was finally found that took up the bill that had failed in the Bundesrat in February and led to individual amendments to the previous government draft.

No change in the scope of application of the HinSchG

The compromise reached with the CDU/CSU does not provide for any changes in the scope of the HinSchG. For the CDU/CSU parties, the broad scope of the HinSchG was apparently non-negotiable. Thus, the HinSchG continues to go beyond the requirements of the EU Directive. For companies, this means that companies with more than 249 employees must set up internal reporting channels through which whistleblowers can submit reports in a protected and confidential manner. For companies with 50 to 249 employees, this obligation will apply from 17 December 2023. According to the explanatory memorandum to the law, companies that belong to a group have the option of using a group-wide reporting channel.

As already provided for in the last drafts of the HinSchG, whistleblowers will be protected not only in the case of tips about violations of EU law, but also in the case of tips about violations of national law, in particular criminal offences and certain administrative offences.

No obligation to receive and process anonymous tips

The Union's main concern and the most important innovation for companies is that they are no longer obliged to process anonymous reports and to set up a secure communication channel (a digital whistleblowing system) for this purpose. However, anonymous reports must be processed "anyway". This change is based on the fear that anonymous reports could be used to denounce employees. At the same time, companies should be spared the effort of implementing the HinSchG.

The concern that the HinSchG should not contribute to denunciation is in itself understandable and comprehensible. However, practical experience shows that denunciations in connection with whistleblower systems are the exception. On the other hand, companies that already operate a voluntary whistleblower system have found that justified reports of violations are often made anonymously.

Lower fines and other changes

The fine range for violations of the HinSchG has been changed. The maximum fine was reduced from up to 100,000 euros to a maximum of 50,000 euros. Although the provisions of the HinSchG are supposed to come into force one month after promulgation, fines against companies that have not yet set up a whistleblower system will not be imposed until six months after promulgation of the HinSchG.

Changes have also occurred from the perspective of potential whistleblowers: It is worth mentioning that compensation for immaterial damages (damages for pain and suffering) in case of disadvantages due to whistleblowing has been abolished. The reversal of the burden of proof in favour of the whistleblower in the case of discrimination provided for in the law only applies if the whistleblower explicitly claims that the disadvantage is based on the report made.

Conclusion and perspectives for companies

Despite all the criticism, whistleblower systems will (have to) also find their way into German companies. A whistleblower system has been one of the most important components of a functioning compliance management system for several years, yet the topic was viewed critically in many companies for a long time.

From a compliance perspective, the question of whether or not companies should follow up on anonymous tips can clearly be answered in the affirmative. There are several reasons for this: The possibility of anonymous reporting offers many whistleblowers an additional measure of security and is often the trigger for making a report at all. This is not likely to change with the future legal protection of whistleblowers against discrimination. Without the possibility of anonymous reporting, there is a risk that whistleblowers will either turn to the (state) external reporting office or refrain from reporting altogether. Neither would be in the interest of the companies concerned.

In addition, company management is already obliged by virtue of its duty of legality to follow up on plausible indications of legal violations, regardless of whether they are made anonymously or not. Last but not least, the receipt of anonymous tips can also play a not insignificant role in the question of whether an established compliance management system can be considered effective. Effectiveness, in turn, is an essential criterion in the assessment of a corporate fine. Receiving and processing anonymous tips is therefore still strongly recommended to companies.

For all companies that have not yet set up a whistleblower system, there is a need for action now. Setting up a whistleblower system is a project that should not be underestimated and for which sufficient time should be planned. During implementation, a number of questions regarding whistleblowing, labour law and data protection need to be clarified. Small and medium-sized enterprises must also clarify who (inside or outside the company) should act for the whistleblowing office to be set up.

Finally, companies with foreign subsidiaries must not only observe the requirements of the German HinSchG, but also the national whistleblower protection laws of the respective member states.

Too much to consider?

Do you have questions or are you looking for a partner to help you with an initial internal review of how you should implement the law in your company? Are you looking for suitable software or a partner for the operation of a reporting channel and the processing of whistleblower cases? We are here for you. Simply send us an e-mail at hi@konfidal.eu or call us at +49 (0) 176 72224558.