WHISTLEBLOWING: THE GERMAN PARLIAMENT PASSES THE WHISTLEBLOWER PROTECTION ACT

Whistleblowers will be able to draw attention to violations of laws and regulations in companies and public authorities more easily and without fear of reprisals. This is the aim of a draft law by the federal government (20/3442), which the German Parliament passed on 16 December 2022 in a version amended by the Legal Affairs Committee (20/4909). The main idea is to set up reporting offices in companies to which whistleblowers can turn. This implements EU requirements (delayed). The second passage in the German Federal Council is expected to take place in its first session at the beginning next year. The provisions which may be relevant for your company are summarised below.

Range of application

Companies with usually more than 50 employees are obliged to set up a department for internal reporting to which employees can turn and to establish corresponding reporting channels. In the case of companies with 50 to 249 employees, a longer implementation period until 17 December 2023 applies. Certain companies in the financial services sector (e.g. credit institutions) are obliged to set up internal whistleblowing systems regardless of their number of employees.

The internal reporting mechanism must be made available to employees. However, companies can also open this to third parties to demonstrate their compliance awareness. This is particularly interesting for companies which, due to their number of employees, fall under the Act on Corporate Due Diligence to Prevent Human Rights Violations in Supply Chains (German Supply Chain Sourcing Obligations Act – "Lieferkettensorgfaltspflichtengesetz") and have to set up a complaints procedure anyway, not restricted to employees.

In addition to the violations of EU law covered by the Directive, the Whistleblower Protection Act also covers violations of national criminal and fine provisions (to the extent that the provision serves to protect life, limb or health or to protect the rights of employees or their representative bodies). The Whistleblowing Protection Act thus meets the expectations for comprehensive protection of whistleblowers and follows other member states.

Establishment of (anonymous) reporting channels

According to the Whistleblowing Protection Act, internal and external reporting channels must offer the possibility of anonymous reporting and subsequent anonymous communication with the whistleblower from 1 January 2025. The legislator justifies the later entry into force of this obligation to report anonymously with the additional costs for the necessary technical facilities or the commissioning of an ombudsperson as well as with the additional burdens for the concrete establishment of the reporting office.

The processing of anonymous reports is obligatory.  For companies whose reporting channel has so far been the classic "complaint box" (letter box), this change will involve effort. Such a letterbox is unlikely to meet the demand for anonymous communication. It remains open whether the simple e-mail address as a reporting channel (still) meets these requirements.

Affiliated Company Solution

For affiliated companies, the concentration of expertise for the processing of internal reports is often essential in order to ensure fast and professional processing. To ensure this, the legislator has adopted the so-called "affiliated company solution". According to this, individual affiliated companies, which usually do not have an independent compliance function or even a compliance department, can outsource their internal reporting office to a group-wide central reporting office. This presupposes that the group-wide central reporting office complies with confidentiality obligations and is independent. In addition, the use of such a central reporting office must not imply any hurdles for the whistleblower. It should therefore be possible to submit a whistleblower report in the working language prevailing in the respective individual company. The German legislator compares the central reporting office in the group with "outsourcing" to an external law firm; both are "third parties" in the sense of Art. 8 para. 5 EU Whistleblowing Directive (RL 2019/1937). The original responsibility to clarify, stop and punish the reported incident remains with the individual affiliated companies in any case.

When processing through a central reporting office, internal separation according to the respective subsidiaries must be ensured. The confidential processing of reports must also be ensured. A report (while maintaining the confidentiality of the identity of the whistleblower) to the group management should only be made by or on behalf of the respective affiliated companies.

It remains to be seen whether this interpretation of the group parent company as a "third party" will stand up under EU law.

Retention period

In order to create a synchronisation with the regular statute of limitations under German civil law, the Whistleblowing Protection Act provides for a retention period of three years. This still does not resolve the question of how the seven-year retention period of the notification procedure under the Supply Chain Sourcing Obligations Act relates to the three-year period under the Whistleblowing Protection Act. In this respect, companies will have to establish and maintain a strict deletion concept in the future.

Monetary risk

The fine provisions of the Whistleblower Protection Act go beyond the Directive and are particularly explosive in practice. Anyone who prevents (or attempts to prevent) a report or subsequent communication, anyone who takes (or attempts to take) prohibited reprisals or anyone who intentionally or negligently disregards the confidentiality requirement will be fined up to EUR 100,000. In addition, the Act provides for a fine of up to EUR 20,000 for failure to establish and operate an internal reporting system.

This fine applies to legal persons if a management person has committed the administrative offence. At the same time, violations of supervisory duties can be sanctioned. In particular, the reference to sec. 30 OWiG makes it possible for the maximum fine to be increased tenfold for certain violations.

Protection of whistleblowers

The Act also prohibits any kind of reprisals against whistleblowers. In the event of a violation of the prohibition of reprisals, the perpetrator is obliged to compensate the whistleblower for the resulting damage. If, following a report or disclosure, the whistleblower suffers a disadvantage in connection with professional activity, it is presumed that this disadvantage constitutes reprisal. In this case, the person who has prejudiced the whistleblower has to prove that the prejudice was based on sufficiently justified reasons or that it was not based on the report or disclosure. The mere fact that a whistleblower is not considered for a promotion, a transfer or even the non-extension of a fixed-term employment contract could possibly be regarded as reprisal, with the consequence that the employer would have to prove that this was not a disadvantage to the whistleblower because of the report he or she made. If this exculpatory evidence does not succeed, the company may face claims for damages and fines.

The provisions on damages were also strengthened. Whistleblowers will be able to invoke a separate legal provision for non-material damages and claim monetary compensation. Hereby, an explicit legal regulation in the sense of compensation for pain and suffering was created. Reprisals can take many forms and especially in the case of psychological stress such as mobbing or stalking, it is often difficult to prove an injury. Especially since the courts have difficulties in classifying the necessary assessment factors in these cases anyway. Full redress takes sufficient account of the European requirements and also strengthens the confidence of whistleblowers and thus the effectiveness of whistleblowing systems through far-reaching protection of whistleblowers.

Addressing the issue of whistleblower systems should no longer be postponed by affected companies. We are happy to support you with an analysis of existing structures and with questions regarding the implementation of a whistleblower system. If you have any questions and for more information, get in touch with our German EPI Team.