Good Things Come to Those Who Wait: German Bundestag Passes Whistleblower Protection Act

Having already reported on the current status of the Whistleblower Directive (WB-Directive) and the progress of the Whistleblower Protection Act (HinSchG) - as an implementing law for the Directive - the time has finally come: The Bundestag passed the HinSchG on December 16, 2022. The aim of the law is to protect whistleblowers from reprisals if they report irregularities in the company. The protection provided by law relates, among other things, to dismissals, exclusions or other adverse consequences under labor law.

After many criticisms of the original draft, there are now a number of changes that companies will have to observe in the future. Although some of these criticisms have been incorporated into the wording of the law, legal uncertainties remain in various places.

The most important changes at a glance:

Anonymous reports

§ 16 (1) Sentence 4 HinSchG is probably the most significant change to the originally envisaged regulations. In response to criticism - which we believe was justified - companies will now be required to accept anonymous reports and subsequently process them. Despite fears that such an approach could be used for abusive reporting, the creation of a further incentive for internal reporting ultimately prevailed.

So far so good: anonymous reporting channels not only lower the "inhibition threshold" for submitting a corresponding (internal) report, but ultimately also promote the protection of the respective whistleblower.

In addition to preserving the anonymity of the whistleblower himself, the respective reporting channels must also be kept anonymous in accordance with Section 16 (1) sentence 5 HinSchG. Since the HinSchG also requires further (subsequent) communication with a whistleblower, a pragmatic solution must also be found in the case of anonymous reporting. This confronts companies with the task of taking appropriate technical precautions into account, when selecting and implementing a reporting channel. If, for example, only an "ordinary" mailbox or the receipt of a report by e-mail was previously provided, this will probably no longer be sufficient to the new requirements of the HinSchG. Even if this means a certain amount of additional work, in the future, companies will have no choice but to check tools from various providers to see whether they allow anonymous communication.

To make things easier: Since these requirements came to a certain extent "suddenly", § 42 (2) HinSchG at least provides for a transition period until January 1, 2025. Since the WB-RL does not provide for anonymous reporting channels, companies still have some time to adapt their reporting channels.

Internal hotlines as preferred approach?

Even though whistleblowers are in principle free to choose whether they first contact an internal or external reporting office (cf. § 7 (1) HinSchG), internal reporting offices are nevertheless somewhat "emphasized". This is reflected in particular in the provision of § 7 para. 3 HinSchG, which expressly allows the employer to create incentives for internal reporting. No further substantive requirements are imposed in this regard.

In our opinion, this adjustment is also understandable and ultimately sensible. In particular, by processing the respective reports internally, compliance violations can be quickly uncovered and dealt within a targeted manner. Insofar as the content requirements for the protection of the whistleblowers are sufficiently safeguarded, it would in our opinion also make no sense to "urge" the employer - due to the equivalence of the reporting offices - to violate the HinSchG if he "advertises" his own internal reporting office. However, there is no "real innovation" in this respect, since the previous advisory practice also tended to make the own reporting channel as attractive as possible.

It has also remained unchanged that whistleblowers must first contact an internal or external reporting office before providing information to the public leads to protection against reprisals.

Group-wide reporting points still possible

The provision in § 14 (1) HinSchG, which allows Group-wide reporting offices, has also remained unchanged. The provision also expressly states, that a hotline can also be operated by a "third party" (e.g. a law firm). It must be noted, however, that such outsourcing does not relieve the reporting office of its further obligations to take additional measures.

Although this cannot be directly inferred from the wording of the law, according to the explanations in the explanatory memorandum to the law, such group companies, which perform the task of the reporting office centrally for the entire group, are classified as "third parties". This is "astonishing" in this respect, as there is a clear contradiction here to the express legal interpretation of the European Commission. It remains to be seen, whether and to what extent the German regulation will stand up to scrutiny under European law.

In any case, a group-wide solution for the introduction of a reporting office must not lead to any complications for the persons providing information. This may mean, for example, that any barriers - such as those of a linguistic nature - must be effectively countered. In addition, companies must pay attention to whether and how a possible group-wide solution is actually reflected in the respective regulations of the member states. This patchwork of different requirements must be taken into account when choosing a group-wide solution.

Compensation also for immaterial damage

Contrary to what was originally envisaged, whistleblowers will in future also be able to claim non-material damages in accordance with the provision of § 37 (1) sentence 2 HinSchG, insofar as a violation of the prohibition of reprisals has occurred. Irrespective of the requirements of § 253 (2) of the German Civil Code, monetary compensation can therefore also be claimed if "only" a violation of the right of personality has occurred.

The background to the new regulation are the requirements of the WB-RL, which demand full compensation for damages incurred.

What has to be considered for an internal reporting office?

• In order to comply with the requirements of the HinSchG, companies must - in addition to the criteria already outlined - also pay particular attention to the following points:
• The persons entrusted with the tasks of the reporting office must be competent and able to perform the tasks assigned to them independently.
• The reporting procedure must be provided with clear deadlines for the course of the procedure and must also provide for clear deletion deadlines. Another interesting question - and one that has not yet been conclusively clarified - is how the 3-year retention period now envisaged for the corresponding documentation relates to the 7-year retention period in the Supply Chain Disposal Obligations Act.
• In the event that a notification is received, the company must take further follow-up measures, such as internal investigations or submitting the case to a competent authority.

In addition, the requirements of the GDPR as well as the German Data Protection Law must be observed - as usual. Even if § 10 HinSchG provides for an explicit regulation on the processing of personal data, the other measures to ensure effective data protection compliance must of course also be observed. This can sometimes lead to the necessity of a data protection impact assessment or the conclusion of contracts for commissioned data processing pursuant to Art. 28 GDPR.

Outlook

As the HinSchG is a so-called consent-requiring law, the Bundesrat must still give its consent before the law can enter into force. The next plenary session will take place on February 10, 2023, which is why we expect the law to be promulgated before the end of the first quarter of 2023.

Companies with a regular employment figure of 50 to 249 employees still have time until December 17, 2023 to implement the relevant requirements of the HinSchG. In contrast, companies with a regular employment figure of over 249 employees should "waste no more time".

We are happy to support you with our expertise in data protection and labor law in implementing a whistleblower system. All sample documents on data protection and labor law are available and can be offered to our clients at reasonable flat rates.

Your SKW Whistleblowing Team