Whistleblower Protection Act - Important for 2023

Although whistleblowers may be more commonly associated with the media or movies, the Whistleblower Protection Act (HinSchG) is a real law specifically designed to safeguard this group from retaliatory measures. Moreover, companies are expected to benefit from this new legislation, as it brings greater emphasis on compliance. The basis of the Whistleblower Protection Act lies in the EU Whistleblower Directive (WFD), which was adopted in 2019 and became effective from then onwards. Drawing upon this directive, the German legislature developed its own law, which has the potential to be a transformative force for associations, authorities, and companies. Therefore, organizations affected by this legislation should thoroughly acquaint themselves with its provisions and regard the Whistleblower Protection Act as an opportunity for positive change.

The Whistleblower Protection Act will be passed soon and therefore companies with 50 or more active employees need to prepare for the new legislation. Looking at the EU Whistleblower Directive, the Whistleblower Act will require companies to implement a whistleblower system. Learn more in this blog post.

Whistleblower Directive - under which template was the Whistleblower Act developed?

The German Whistleblower Protection Act will be similar in content to the European Union Whistleblower Directive, as this is used as a template. The EU Whistleblower Directive consists of four key points, which form the basis of the legislation and will also form the basis in the national law.

1. Internal reporting channels are to be established
2. External reporting channels are to be established
3. Obligatory clarification of the facts at hand
4. Protection of the whistleblower and thus prohibition of reprisals

These four pillars are the minimum requirements that the German Whistleblower Protection Act must fulfill in order to be effective. Therefore, it is imperative that this basis be transformed into applicable law. It can be assumed that the Whistleblower Protection Act goes beyond this minimum standard, as the Whistleblower Directive of the European Union only refers to tips and violations of applicable EU law. Examples include environmental protection, money laundering, terrorist financing and data protection. A national whistleblower protection law should also include references that refer to violations of applicable national law. Given that the ruling parties have reached consensus in their coalition agreement, it is reasonable to expect that reports pertaining to breaches of domestic laws and regulations will be encompassed within the legislation. At the same time, reports of misconduct will be considered if it can be demonstrated that addressing them serves the public interest.

The National Whistleblower Protection Act

When examining Directive (EU) 2019/1937, one will observe that the European Parliament mandates the implementation of this directive solely through national legislation.For this reason, initial attempts were launched by the Grand Coalition to define a whistleblower protection law - the first draft was subsequently prepared by the Federal Ministry of Justice and Consumer Protection. The SPD-led ministry's draft earned criticism, as glaring loopholes were discovered and some key points were listed factually incorrectly. Particular criticism was levelled at the fact that the protection of whistleblowers was excluded from the draft and that the draft thus missed its actual intention. A whistleblower protection law without the points of confidentiality, data protection, the conduct of internal searches and the protection of the persons connected with the tips was seen as incomplete. Furthermore, the Grand Coalition was rather skeptical because a whistleblower should enjoy protection for all reports, even if they were to be classified as subject to criminal penalties or fines.

From the EU Directive to the Whistleblower Protection Act - a Long Road

To understand the genesis of the Whistleblower Protection Act, it is necessary to look at the date when the EU Directive came into force. From this date, it is possible to chronicle the emergence of the national whistleblower protection law and ascertain some interesting details. 

1. December 2019 - The way for a national whistleblower protection law is opened and thus the EU Directive 2019/1937 enters into force. The important thing here is that all member states are granted two years to transform the above directive into a national law and adopt a corresponding law.
2. November 2020 - After almost one year, the Federal Ministry of Justice and Consumer Protection presents a first draft, which is supposed to show an implementation of the directive and will be a first step regarding the implementation of a whistleblower protection law.
3. April 2021 - The Grand Coalition stops the development of the Whistleblower Protection Act, as the existing partners cannot agree on the scope of the whistleblower protection. At the same time, there is disagreement and no agreement can be reached on tasks and responsibilities.
4. December 2021 - The coalition, consisting of the SPD, FDP and Green parties, agrees on a coalition agreement that includes the plan to implement the EU directive in a legally secure and practicable manner.
5. December 2021 - No whistleblower protection law has yet been passed in the Federal Republic of Germany, although the deadline has been exceeded. This means that the requirement under EU Directive 2019/1937 has not been met.
6. December 2021 - There is a statement from the Federal Ministry of Justice from Federal Minister of Justice Marco Buschmann (FDP) regarding the planned Whistleblower Protection Act. In an interview given to the Frankfurter Allgemeine Zeitung, Buschmann states that he does not consider the EU directives to be immediately applicable and that for this reason the Whistleblower Protection Act should be implemented with priority. At the same time, Buschmann emphasizes that the national law should be more far-reaching than the European guidelines. The whistleblower is to be regarded as an important component and thus the whistleblower is to be safeguarded by German law.
7. December 2022 - Pressure is also mounting in the Bundestag and two members of parliament attending the simplified "Law" debate declare that the existing EU directive should be swiftly transposed into national law.
8. February 2022 - The EU Commission increases pressure to ensure the timely implementation of the Whistleblower Protection Act. Germany is officially reminded to convert the EU directive into law, as a failure to do so within the remaining few months could result in infringement proceedings. Prompt implementation is crucial to avoid undesirable sanctions.
9. April 2022 - The German Federal Ministry of Justice publishes another draft of the Whistleblower Protection Act, which is entitled "Referentenentwurf eines Gesetzes für einen besseren Schutz hinweisgebender Personen sowie zur Umsetzung der Richtlinie zum Schutz von Personen, die Verstößen gegen das Unionsrecht melden". This draft is also not convincing, but states and associations are given the opportunity to express their opinion on the draft.
10. June 2022 - There is a great interest in commenting and thus 50 comments from associations and federations are registered regarding the draft.
11. December 2022 - It is established that a whistleblower is recognized in terms of responsibility and thus no disadvantages would befall them. Special protection of whistleblowers is agreed upon in light of this. Consequently, the Whistleblower Act was successfully passed by the Bundestag on December 16, solidifying adequate protection for whistleblowers.
12. February 2020 - On February 10, 2023, the Bundesrat (upper house of the German parliament) initially did not give its approval for the new law. Now the next session remains to be seen.

The Whistleblower Protection Act in the Coalition Agreement

Examining the contents of the coalition agreement, one can anticipate that the Whistleblower Protection Act will possess a distinct and legally robust framework. Of particular significance within the agreement is the emphasis on "entrepreneurial law," which highlights the importance placed on both companies and whistleblowers. This aspect deserves considerable attention and scrutiny by all stakeholders involved.

“We are implementing the EU Whistleblower Directive in a legally secure and practicable manner. Whistleblowers must be protected from legal disadvantages not only when reporting breaches of EU law, but also significant breaches of regulations or other significant misconduct, the disclosure of which is in the particular public interest. We want to improve the enforceability of claims for reprisals against the wrongdoer and are looking into advisory and financial support services for this purpose.”

For whistleblowers who are also employees, it is crucial that occupational health and safety be monitored by the Ministry of Labor. If the concerns of companies are at stake, the Ministry of Economics will want to exert influence to represent the interests of companies.

In recent years, companies have had to come to terms with a constant stream of new legislation, and the introduction of the General Data Protection Regulation has shown many a company its limits. Therefore, it is crucial to seek a practical solution for whistleblower protection that can be effectively implemented by companies without giving rise to insurmountable challenges.

Whistleblower Protection Act - Notifications

Looking at the core of the Whistleblower Protection Act, the protection of the whistleblower is, of course, in the foreground. The protection of the whistleblower must be defined in this law in such a way that bullying, discrimination and, of course, dismissals are ruled out. To ensure this, a reporting channel must be established in companies and institutions, with the help of heyData's mattersOut for example. These channels are vital for organizations and companies, as they need to be initiated by the companies themselves to effectively address and investigate any reported indications. Companies must make sure that the reporting channels are easily accessible to every employee and that the reporting channels are actively pointed out. For companies, these reporting channels represent a clear advantage because whistleblowers do not immediately communicate a tip to an authority, but the company is informed directly through the channel provided. An employee must not misunderstand the reporting channel, as the purpose of this channel is not to hide faulty compliance from the authorities, but to provide internal clarification. This clarification allows companies to respond quickly and assess facts. A reporting channel should be seen by companies and employees as a kind of warning system that gives them the chance to increase compliance in the long term. Companies will benefit from a reporting system, as grievances do not immediately become public knowledge, thus avoiding a loss of image and financial losses. At the same time, a reporting system also strengthens employees' trust in the company and shows that poor compliance can be improved in cooperation with employees.

What must a reporting channel do?

When evaluating a reporting channel, it is essential to ensure that it meets certain minimum requirements to effectively adhere to the Whistleblower Protection Act:

• The reporting channel may only be used internally and thus access must be denied to unauthorized persons.
• The whistleblower must be protected by the reporting system - the identity of the whistleblower remains hidden and persons involved are also protected.
• To comply with the Whistleblower Protection Act, the company must make a commitment to provide feedback to the whistleblower. This feedback should be given within a maximum of seven days. Additionally, within a period of three months, the company is required to inform the whistleblower about the actions taken in response to the report and any resulting consequences.
• heyData is prepared for the new legislation and offers companies a compliance revolution with its mattersOut product, which observes the requirements of the Whistleblower Protection Act, providing a secure and simple communication channel that supports companies and employees in uncovering and eliminating wrongdoing.

Management of the reporting channels

In principle, a reporting channel should be professionally managed by an internal employee or by an external body. It is important here that the processing always takes place impartially and thus independently. The administrator of the reporting channel must not be influenced or manipulated by the management or by other bodies. It is to be hoped that the Whistleblower Protection Act will include examples of how to ensure the independence of a person in charge so that the work can be carried out without interference.

It is important to recognize that an internal employee responsible for the reporting channels lacks true independence due to their employment within the company. The initial draft law of the Grand Coalition did not adequately address this issue, focusing only on avoiding conflicts of interest, which can still impact their effectiveness. To address this, an independent ombudsman, such as commissioned lawyers or qualified management consultants, could provide a solution by operating externally and impartially evaluating and managing the reported information. Additionally, it is essential for the Whistleblower Protection Act to define and emphasize the need for training. Special attention and support through training measures should be provided to the individual overseeing the reporting channels.

External reporting channels

Companies and organizations are responsible for establishing internal reporting channels independently. However, in line with the existing EU Directive, the Whistleblower Protection Act also aims to define and regulate external reporting channels. These established reporting requirements are covered by a defined authority. If one adheres to the EU Directive, the Whistleblower Protection Act must cover and guarantee the following points:

• The handling of whistleblowing cases must be entrusted to an authorized supervisory authority, which will possess the necessary expertise to receive incoming reports, provide appropriate feedback, and initiate necessary follow-up measures.

According to the EU directive, the responsible authority must be provided with the necessary resources to ensure a smooth workflow.

When considering external reporting channels, the EU Directive outlines the following requirements:

• An independent department must be created in the authority complex, which separates between the general information channels of the authority and the reporting channels.
• It must be ensured that all legal framework conditions are complied with. This concerns confidential processing of all information received and, equally, the storage of reports and accountability in relation to the public information function of the authority.
• It is essential to designate specialized whistleblowing officers who have undergone a comprehensive training program. These persons in charge have the subsequent task of receiving the incoming information and evaluating it in a timely manner. At the same time, those responsible have a duty to inform and must provide feedback to whistleblowers and disclose the status of the procedure. An external reporting office is planned, which will be created in the Office of Justice. This reporting office will be designated as the central point of contact and will thus be responsible for the area of whistleblowing.

How can companies make reporting channels more appealing?

It is crucial for companies to ensure that employees recognize the benefits of utilizing reporting channels, as well as how they can improve their own work environment. To achieve this, companies should provide internal consulting services to create a positive perception of reporting channels. Ideally, the Whistleblower Protection Act should include a requirement that obligates companies to offer such consulting services. This offering should clearly communicate to employees how whistleblowers will be handled and the subsequent process that will unfold. Of particular importance is informing employees about the measures in place to protect them against retaliation and the potential consequences of making a report. Additionally, employees need to be educated on the defined timeline of the process and how to provide information anonymously if desired.

Whistleblower Protection Act - Conclusion 

The Whistleblower Protection Act is a challenge for companies and authorities, but it also offers companies great opportunities to make internal improvements. Especially the defined processes are positive for the whistleblower and for the company. In the past, whistleblower reports were often made public, which often led to a loss of image for companies, accompanied by financial losses. This can be effectively prevented by an internal reporting channel. Abuses can be reported internally, giving a company the chance to make improvements before the case becomes public. Employees benefit from the Whistleblower Protection Act because they are actively involved in processes and are given a chance to report grievances without having to fear undesirable side effects. This interaction can bring about improvements within a company and have a positive impact on employee satisfaction. 
In recent years, companies have faced the need to redefine numerous work processes due to changing legal requirements. The implementation of the General Data Protection Regulation (GDPR) was particularly challenging for many organizations. As employees operate at the forefront and often encounter issues related to these new regulations, having a reporting channel in place can assist companies in effectively implementing the new requirements and identifying any gaps. Therefore, the Whistleblower Protection Act should be viewed not as an additional burden, but as a genuine opportunity for employees, companies, and organizations to enhance compliance and foster a culture of transparency.