Germany Ministry of Justice proposes wide-ranging protection for whistleblowers

EU Member States need to implement Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, the so-called “Whistleblowing Directive”, by 17 December 2021. The German Federal Ministry of Justice and Consumer Protection has now prepared a draft bill for a "Law for the Better Protection of Whistleblowers and for the Implementation of the Directive on the Protection of Persons Reporting Breaches of Union Law" (the so-called “Whistleblower Protection Act” – Hinweisgeberschutzgesetz) (the “draft bill”). The draft bill aims to expand the hitherto incomplete protection of whistleblowers and create legal certainty for them.

Key points of the draft bill

Scope 

The draft bill extends to so-called whistleblowers, i.e. natural persons who have obtained information about violations in connection with their professional or official activities, and report or disclose these to the reporting offices provided for in the draft law. The personal scope of application is broad and includes not only employees but also other groups of persons, such as the self-employed, volunteers and members of corporate bodies. According to the explanatory notes of the draft bill, whistleblowers whose employment relationship has been terminated, as well as persons whose employment relationship has not yet begun and who have obtained information about violations during the hiring process or other pre-contractual negotiations, are also included in the scope of application.

In addition, persons who are the subject of a report or disclosure or who are affected by the report or disclosure are also to be protected. This is to ensure that the identity of such persons is protected and that applicable procedural rights are not restricted.

As regards the material scope of application, the draft goes beyond the Directive. It includes criminal law and the law on administrative offences as well as certain other areas of law, such as public procurement, combating terrorist financing, product safety, traffic safety, environmental and radiation protection, renewable energies, food and feed safety, consumer protection, protection of privacy and personal data, as well as security of network and information systems. 

Establishment of reporting offices

Two reporting channels (internal and external) are provided for whistleblowers, which are of equal value and between which whistleblowers can freely choose:

• The establishment and operation of an internal reporting office for whistleblowers will be mandatory for both private companies and public authorities that have at least 50 employees. For certain companies, including investment service providers, stock exchange operators or credit and financial service institutions, the obligation will apply irrespective of the number of employees.
  
  The task of an internal reporting office is to operate suitable reporting channels, to check the validity of the reports and to take follow-up measures.
  
  An internal reporting office can be established by entrusting a person employed by the relevant entity, an internal organisational unit or a third party with the responsibilities of an internal reporting office. Several private companies with a usual workforce of 50 to 249 employees may also operate a joint reporting office or entrust a third party to operate a joint reporting office on their behalf.
  
  Within three months of the report being made, the internal reporting office must provide the whistleblower with feedback on the follow-up measures planned and already taken, and the reasons behind them.

• An external reporting office at federal level is to be established at the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit). This central contact point will function as a "one-stop-shop" and will free whistleblowers from having to ascertain which state office is competent to receive their report. However, the federal states remain free to establish their own external reporting offices.
  
  For certain violations, e.g. breaches of accounting regulations subject to criminal penalties or fines, or for reports concerning regulations governing the rights of shareholders of stock corporations or regulations of the Securities Acquisition and Takeover Act, the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – BaFin) will be the competent external reporting office.
  
  Just like the internal reporting offices, the external reporting offices have to set up and operate reporting channels, check the validity of a report and take follow-up measures. Whistleblowers must also be given feedback within three months of making their report (or six months in complex cases). In addition, the external reporting office must inform the whistleblower of the result of the investigation triggered by the report, once it has been completed.

Disclosure of information

A whistleblower who comes forward with information about violations and discloses it to the public should only be protected if they have either made an external report and not received feedback within the set time limits, or if they have reasonable grounds to believe that there is a threat to the public interest, that the external reporting channel is not working, or that there is a risk of retaliation if the external reporting channel is followed.

Protective measures

In order to protect whistleblowers from retaliation such as mobbing, discrimination or dismissal and provided the relevant conditions are met, the following protective measures are available:

• Provided that the whistleblower had reasonable grounds to believe that supplying information was necessary to uncover a violation, the reporting or disclosure of the information will not be considered a violation of any (contractual) restriction on disclosure.
• Reprisals against a whistleblower (such as dismissal) are prohibited. A procedural reversal of the burden of proof will apply here: if, after a report or disclosure, a whistleblower suffers a disadvantage in connection with their professional activity, it will be presumed that this disadvantage is a prohibited retaliation. In this case, the person who discriminated against the whistleblower (usually the employer) must prove that the discrimination was based on sufficiently justified reasons or that it was not based on the report or disclosure.
• If the prohibition against retaliation is violated, the perpetrator is obliged to compensate the whistleblower for any loss suffered. However, a violation may not give rise to a claim for the establishment of an employment relationship, a vocational training relationship or other contractual relationship, or for career advancement.

However, there are also limits to whistleblower protection. For example, anyone who does not have a sufficient reason to believe that the facts reported or disclosed are true, will not be protected. In addition, the whistleblower is obliged to compensate for any damage resulting from a deliberate or grossly negligent report or the disclosure of incorrect information.

Sanctions

Violations of the main provisions of the draft law are punishable as administrative offences. This applies to the obstruction of reports and taking of retaliatory measures (for which fines of up to 100,000 euros are possible), as well as failing to fulfil obligations to provide information to an external reporting office and breaching the duty to keep the identity of a whistleblower confidential (for which fines of up to 20,000 euros are possible).

Status of implementation 

Companies should continue to follow the implementation process closely. The draft bill is expected to be dealt with by cabinet at the end of March and then go through the parliamentary procedure; the planned conclusion of the procedure is at the end of June 2021. It remains to be seen whether this timetable will be adhered to, especially since the question of "overreaching implementation" is said to remain controversial within the coalition.

However, companies would be well-advised to be prepared for the fact that, in principle, there will be an obligation to set up internal reporting channels from 17 December 2021. Businesses will need to ensure that their reporting systems are operating effectively and in compliance with the various legal requirements, particularly those relating to employment law and data protection. Any existing reporting systems should also be reviewed and revised if necessary. The draft bill provides for a transitional arrangement for small and medium-sized enterprises with a usual headcount of 50 to 249 employees, for which the obligation will only apply from 17 December 2023. Nonetheless, the Whistleblower Protection Act will inevitably lead to a need for action for many companies.