Whistleblower protection in Germany to be expanded beyond EU law requirements

EU Whistleblowing Directive

All EU member states are obliged to implement the EU Whistleblowing Directive’s provisions into national law by 17 December 2021. The main objectives of the EU Whistleblowing Directive are to improve institutional conditions for whistleblowing and to provide whistleblowers with extensive legal protection.

Draft Bill’s most important aspects

• Wide personal scope: The Draft Bill provides protection to individuals who acquired information on breaches in a work-related or professional context and report such information to internal or external reporting channels or, under certain conditions, disclose such information to the public.
• Applicable to breaches of German and EU law: The Draft Bill applies to reports or disclosures of information concerning breaches of law which are subject to fines or criminal sanctions under German law. In addition, breaches of law in specific areas, such as financial supervisory law, data protection law or the prevention of terrorist financing are within the Draft Bill’s scope. The Draft Bill therefore goes beyond the EU Whistleblowing Directive’s requirements as it does not only cover infringements of EU law.
• Protection of whistleblowers: Individuals who report breaches or disclose information in accordance with the procedural requirements of the Draft Bill will for example (i) be protected against retaliation (e.g. suspension, lay-off or dismissal) and (ii) can claim damages due to retaliation, provided that the information on breaches reported is true or that the whistleblower had reasonable grounds to believe that it was true. Notably, under the Draft Bill, it is for the employer to prove that a detriment suffered by the whistleblower was justified or unrelated to the report or disclosure (reversed burden of proof). The whistleblower will, however, be liable for any damage caused by deliberate or grossly negligent reporting of false information.
• Reporting channels and public disclosure: Individuals wishing to report a breach may choose between internal and external reporting channels. Under strict conditions, information concerning breaches may also be disclosed to the public (e.g. in the case of an imminent or manifest danger to the public interest). This differs from current case law in Germany. Courts have held that, in principle, an employee has to report internally before turning to external channels.
• Obligation to establish internal reporting channels: Legal entities in the private sector will be under an obligation to establish an internal reporting channel (interne Meldestelle) (“Reporting Body”) if they generally have 50 or more employees. Entities in certain industries such as financial services will be obliged to establish Reporting Bodies irrespective of this threshold. For companies which generally employ more than 250 people, the obligation to establish such internal reporting channels will be effective from 17 December 2021. Companies with less than 250 employees have an additional two years (until 17 December 2023) to establish a Reporting Body.
• Obligations of the Reporting Body: The Draft Bill provides for detailed rules on the obligations of the Reporting Body. For example, the Reporting Body will be required to confirm receipt of a report within 7 days and to maintain contact with the whistleblower. In addition, the Reporting Body will be obliged to check the validity of the information received and take appropriate follow-up actions such as internal investigations. However, there is no obligation to process anonymous reports.
• Data protection: The Reporting Body must be designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting individual and any third party mentioned in the report is protected. When processing personal data, the Reporting Body must comply with the provisions on data protection, including in particular transparency obligations.
• Administrative offences: The Draft Bill contains a series of new administrative offences. For example, individuals who hinder reports or retaliate against whistleblowers are subject to administrative fines of up to EUR 100,000. Under certain circumstances, this might also lead to administrative fines to be imposed on companies.

Next steps and timeline

Considering the imminent expiry of the implementation period, the German Whistleblower Protection Act might be passed this year and enter into force on 17 December 2021. However, the Draft Bill might be amended during the current discussions within the German government and the subsequent discussions within the German Federal Parliament (Bundestag) and the Federal Council of Germany (Bundesrat).

Outlook

The Draft Bill provides for a comprehensive legal framework to enhance whistleblowing processes and protect whistleblowers. Companies should prepare the implementation of an efficient whistleblowing system which takes into account labour law, data protection law and compliance management. Companies with an existing whistleblowing system will have to carefully observe the legislative process, reassess their systems and may have to adapt structures and procedures to be in compliance with the forthcoming legislation. In addition, companies should keep in mind the risk of being sanctioned with an administrative fine in the case of missing or ineffective supervision. An effective and well-established whistleblowing system encourages employees to speak up internally and often enables companies to respond to compliance issues before they become commonplace.