New draft bill on the Whistleblower Protection Act: will German companies be hit by a further tightening of regulations?

The deadline for transposing the EU Whistleblower Directive 2019/1937 into national law expired in vain on 17 December 2021. Germany is therefore facing infringement proceedings. Now, draft bill of the German Federal Ministry of Justice [Bundesministerium der Justiz, BMJ] on a new Whistleblower Protection Act [Hinweisgeberschutzgesetz, HinSchG] dated 13 April 2022 aims to set the long overdue implementation of the law in motion.

Modifications to the scope of application

Compared to the failed last bill, the material scope of application has been restricted. It does, however, as already announced in the Coalition Agreement, go beyond the European requirements. Besides covering violations of EU law, the scope of application of the former draft also included “all violations that are subject to criminal penalties or fines”. Under the new draft, however, violations that are subject to fines are only covered “insofar as the violated regulation serves to protect life, limb or health or to protect the rights of employees or their representative bodies”. It also includes a list of enumerative infringements, the majority of which correspond to the relevant areas of law according to the recitals of the Directive, however. 

The personal scope of application corresponds to the already broad requirements of the Directive: protected thereunder are natural persons who, in connection with their professional activity, have obtained information about violations under the newly drafted law. In addition to the company's own employees, these may also include self-employed persons, shareholders or employees of suppliers.

Interaction of external and internal reporting channels

The federal responsibility for the external reporting agency has been corrected: according to the previous draft, the responsibility fell to the Federal Data Protection Commissioner, for whom this activity would have been completely outside the realm of his previous duties and would have led to anything but synergies. Now, the external reporting agency is to be located at the German Federal Office of Justice [Bundesamt für Justiz, BfJ]. In addition, the existing reporting systems at the German Federal Financial Supervisory Authority [Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin] and the German Federal Cartel Office [Bundeskartellamt, BKA] are to continue as further external reporting agencies with special responsibilities.

However, the whistleblower is still entitled to choose whether to report the violations externally or (company) internally. Only Sec. 7 (1) sentence 2 of the draft bill on the Whistleblower Protection Act [Referentenentwurf-Hinweisgeberschutzgesetz, HinSchG-E] suggests that internal reporting agencies should be the primary point of contact. According to this provision, “if an internally reported violation has not been remedied”, the “whistleblower is free to contact an external reporting agency”. However, Art. 7 (2) of Directive 2019/1937 provides that member states shall endeavour “to ensure that reporting through internal reporting channels is given priority over reporting through external reporting channels in cases where effective action can be taken internally against the infringement and the whistleblower does not fear reprisals”. Such prioritisation of internal reporting channels cannot be inferred from the German draft law. This would, however, have been beneficial to the protection of the parties to the proceedings. External clarification of suspicions at the preliminary stage of the proceedings is ultimately associated with high risks for the accused party, and especially in view of the fact that no liability for negligence on the part of the whistleblower is envisaged in the draft bill.

No liability for negligent reporting by whistleblowers

The new draft bill on the HinSchG-E only makes whistleblowers liable for damage claims if they have intentionally or grossly negligently reported or disclosed incorrect information. The explanatory memorandum on page 105 of the draft states that recourse for negligent incorrect reporting would be incompatible with the requirements of EU Directive 2019/1937. However, this cannot as such be inferred from the Directive. This is because Art. 6 (1) (a) of the EU Directive provides protection against reprisals only to those whistleblowers acting in good faith who “had reasonable grounds to believe that the reported information on infringements was true at the time of the report and that such information fell within the scope of this Directive”. In this respect, the draft bill increases the protection of whistleblowers beyond the scope of the Directive, based on the argument that excessive requirements for whistleblowers in terms of verifying the accuracy of the information would be misguided. 

Protection of whistleblowers against reprisals

The core of the new German Whistleblower Protection Act is the protective measures in Secs. 33-39 HinSchG-E. The reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination for the person providing the information. Like its predecessor, the draft bill contains a reversal of the burden of proof for proving such discrimination and is accompanied by a claim to damages on the part of the affected party. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower shall only apply in labour court disputes and not in summary proceedings. This will further increase the requirements for documentation obligations, especially for HR departments. 

Anonymous tips and disclosure to the public

In order to protect companies against an excessive burden, companies are not obliged to follow up on anonymous tips. However, anonymous whistleblowers are also protected against reprisals if their initially concealed identity becomes known. The secrecy of the identity of the parties to the proceedings is guaranteed by strict protective regulations. Disclosure of information about violations to the public is subject to strict conditions in accordance with the Directive. This is only possible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures.

Sanctioning by fine regulations

The range of fines is being further expanded by the new draft bill. Violations of essential provisions of the HinSchG-E are classified as administrative offences and can be punished with a fine. This can amount to up to EUR 100,000, for example, in the case of the obstruction of whistleblower reports for companies. It is also an administrative offense not to ensure that an internal reporting office is set up and operated; in this case, a fine of up to EUR 20,000 may be imposed pursuant to Sec. ​40 (2) No. 2, (6) HinSchG-E. Companies should therefore already implement appropriate protection mechanisms now.

(In)admissibility of group-wide whistleblower systems?

It is interesting to note that the draft bill - despite statements by the EU Commission to the contrary - expressly states in its explanatory memorandum that a group-wide whistleblowing system is permissible. Opinions of the EU Commission dated 2/29 June 2021 state that group-wide whistleblower systems do not meet the requirements of the Directive. Only a pooling of resources for companies with up to 249 employees is possible under certain conditions derived from Art. 8 (6) of the EU Directive. In contrast, the explanatory memorandum to Sec. 14 HinSchG-E, which regulates the organisational forms of internal reporting channels, states on p. 85 of the draft: “In accordance with the principle of separation under group law, an independent and confidential body may also be established at another group company (for example, parent company, sister company, or subsidiary) as a “third party” within the meaning of Article 8 (5) Whistleblower Directive, which may also act for several independent companies in the group. In this context, it is necessary - as is the case elsewhere when supporting companies - that the original responsibility for remedying and following up an identified infringement always remains with the respective mandating subsidiary”. For group companies, this deviation from the Commission's requirements is likely to create additional uncertainties in the legal design of internal reporting channels due to the threat of their unlawfulness under European law. 

Ambiguities concerning the legal consequences

According to Sec. 3 (2) No. 2 HinSchG-E, “violations” capable of being reported do not have to be illegal. It is enough for them to be abusive “because they run counter to the aim or purpose of the regulations in the provisions or areas of law that fall within the material scope of application under Sec. 2”. The Whistleblower Protection Act does not regulate the possible consequences of such a “legal violation”. 

It remains to be seen whether the government draft will make further improvements to the draft bill. As we have explained, there is cause for this in various places. We will keep you informed about further developments.

Back to list