The Whistleblower Protection Act is coming - Draft bill for the Whistleblower Protection Act to implement the Whistleblower Directive is now available

We already reported on the Whistleblower Directive (Directive (EU) 2019/1937) here. The national legislators have been instructed to transpose this directive into national law by December 17, 2021. For companies with up to 249 employees, this obligation is to apply only from December 17, 2023. Now there is a draft bill available for a corresponding implementation law by the Federal Ministry of Justice and Consumer Protection. The new act on the protection of whistleblowers (Whistleblower Protection Act - HinSchG) is intended to expand the previously incomplete and inadequate protection of whistleblowers.

Scope

The HinSchG regulates the protection of natural persons who have obtained information about violations in connection with their professional or official activities and report or disclose such information to the reporting channels provided for under this Act (whistleblowing persons). In addition, natural persons who are the subject of a report or disclosure, as well as other persons affected by a report or disclosure, are also protected.

Obligation to establish internal reporting channels

In accordance with the requirements of the Whistleblower Directive, companies with 50 or more employees, municipalities with 10,000 or more inhabitants, and public authorities are required to set up reporting systems for whistleblowers. For certain companies, the obligation to set up internal reporting channels applies irrespective of the number of employees, e.g. for securities service providers within the meaning of Section 2 (10) of the German Securities Trading Act.

The Whistleblower Directive leaves it up to the EU member states to decide whether only reports of violations of EU law or also violations of national law should be covered by the national implementation laws. The German legislator has decided that provisions subject to criminal penalties and fines should also fall within the scope of the German Whistleblower Protection Act. The reason given for this is to avoid contradictory interpretations, because if the Whistleblower Directive were simply implemented, violations of European public procurement law would fall within the scope of the Whistleblower Protection Act, but serious economic crimes would not.

Tasks of the reporting channels and other requirements

In the case of internal reports, the internal reporting channel shall acknowledge receipt of a report to the whistleblower no later than seven days, maintain contact with the whistleblower, verify the validity of the report received, request further information from the whistleblower if necessary, and take appropriate follow-up action.

Internal reporting channels must allow reports to be made orally or in text form. At the request of the person making the report, a face-to-face meeting with the persons responsible for receiving a report at the internal reporting channel must be made possible for a report within a reasonable time.

It should also be emphasized that the whistleblowing channels are not to be obliged to follow up anonymous tips. The identity of both the whistleblower and the persons otherwise affected by the report must be treated confidentially by the reporting office.

The draft law also provides for specific regulations on the procedures to be followed after a report has been received. This relates in particular to documentation requirements, deadlines for feedback to the whistleblower and follow-up measures such as internal investigations.

Furthermore, the draft law stipulates that internal reporting offices must maintain independence and be free of conflicts of interest. An internal reporting channel can be operated on the one hand by a person employed by the company and on the other hand by an internal organizational unit. For example, the compliance officer, an employed person from the legal department or the company's data protection officer may be considered.

However, the draft law also expressly provides that external third parties, such as lawyers, can be appointed as ombudspersons. The companies concerned therefore have a right of choice here in order to be able to adapt a whistleblower system to the specific needs of the company.

In addition, it should be possible for companies with between 50 and 249 employees to operate a joint reporting channel with other companies for reasons of cost and organization.

Right to choose between internal and external reporting

In addition to internal corporate reporting channels, the draft law also provides for the establishment of external reporting channels by the federal and state governments. Individuals who intend to report information about a violation can choose whether to contact an internal reporting channel or an external reporting channel. This is intended to encourage companies to make their internal reporting channels as attractive as possible.

If an internally reported violation has not been remedied, the whistleblower is free to subsequently contact an external reporting channel.

Protective measures

Whistleblowers are protected from reprisals, such as dismissal or non-promotion, if the relevant requirements are met. In this respect, a reversal of the burden of proof applies: If a whistleblower suffers a disadvantage in connection with his or her professional activity following a report or disclosure, the person who disadvantaged the whistleblower must prove that the disadvantage was based on sufficiently justified reasons or that it was not based on the report or disclosure.

Practical tips

To date, this is only a draft bill. However, it is expected that the Whistleblower Protection Act will be passed before the end of 2021. When the act comes into force, companies will then be obliged to set up internal reporting channels. Companies should prepare for the coming regulations by setting up appropriate reporting channels and training employees. A good internal reporting system can also lead to employees turning to internal rather than external reporting channels. Companies that already have an internal reporting system must check whether it meets the new legal requirements for reporting channels and the procedures to be followed.

In the future, a well-functioning whistleblower system will be an important component of an effectively functioning compliance management system.

In further articles, SKW Schwarz Rechtsanwälte will report in detail on the specific obligations that companies face.

The experts at SKW Schwarz Rechtsanwälte will be happy to answer any questions you may have about the Whistleblower Directive.