Whistleblower Protection Act – Overview and Practical Implementation

The implementation of the EU requirements for whistleblower protection in Germany has finally been completed. The EU Whistleblower Directive 2019/1937 of 23 October 2019 (WFD) and its implementation into national law of the EU Member States should create balanced and efficient whistleblower protection at both European and national level. As early as July 2022, the Federal Cabinet had adopted a government draft for the Whistleblower Protection Act. At that time, the infringement proceedings against the Federal Republic of Germany were already in progress, as it had missed the deadline of 17 December 2021 for implementing the Directive. In December 2022, the draft of the Whistleblower Protection Act was passed in the Federal Parliament in 2nd and 3rd readings but failed in February 2023 due to the lack of approval of the Federal Council, which is made up of representatives of the federal states. As a consequence, on 14 March 2023 the federal government divided the Whistleblower Protection Act into two laws. In his opinion only one of the two laws would need the approval of the Federal Council. At short notice at the end of March, the subject was removed from the agenda and the Mediation Committee was called to mediate between the Federal Council and the Federal Parliament. After the federal government and the states were able to agree on a compromise, the Federal Parliament passed the amended draft on 11 May 2023. On 12 May 2023, the Federal Council approved the Whistleblower Protection Act. In place of the two previous drafts, the final Whistleblower Protection Act is formed by this compromise between the federal government and the states.

Violations Covered and Persons Protected

The Whistleblower Protection Act aims to expose a broad range of violations and goes beyond what is required by the EU Whistleblower Directive. In addition to criminal offences, this also includes regulatory offenses, as far as the violated provisions concern the protection of life, body or health or the protection of employee rights or the rights of their representative bodies. These provisions are e.g. occupational health and safety regulations, violations of the Minimum Wage Act or provisions of the Temporary Employment Act. As provided for by the EU Whistleblower Directive, violations of various European legal acts are covered, including provisions regarding anti-money laundering, environmental protection, animal protection, consumer protection, and data protection.

Information on breaches only fall within the scope of the Whistleblower Protection Act if they relate to the employer or other entities to which the whistleblower is in a business relation.

Establishment of Reporting Units

The most extensive task for employers will be the establishment and operation of internal reporting units. This extends to employers with generally more than 50 employees as well as to employers in specific sectors such as asset management companies. Whistleblowers can choose whether to contact an internal or external reporting unit. External reporting units are provided by the government. However, the wording of the law indicates that they should prefer to report to an internal reporting unit in case the violation can be addressed in an effective manner internally and they do not have to worry about reprisals. In the process, internal reporting units must provide employees with clear and easily accessible information on external reporting procedures and relevant reporting procedures of EU institutions, facilities or other bodies.

While for employers with usually between 50 and 249 employees, the legal obligation to introduce an internal reporting unit will not take effect until December 2023, while employers with usually more than 249 employees are already obliged from the time the law comes into force, which is expected in mid-June 2023.

Organisational Structure of Reporting Units

The federal and state governments agreed that the law waives the obligation to accept anonymous reports. This applies to both internal and external reporting units. It is merely stipulated that the offices should also process anonymous incoming reports. 

The operation of the internal reporting unit can either be provided by employees in an independent team of the employer or by a third party (e.g. external provider of a digital whistleblowing system). The reporting units must be designed in such a manner that only the persons responsible for receiving and processing the reports and the persons supporting them have access to the incoming reports. In addition, the reporting units must allow reports in oral or text form, i.e. also by telephone or other voice transmission. In doing so, the reporting units must protect the identity of the persons providing information, the persons concerned and other persons named in the report.

Recommended Procedure of the Reporting Process

Employers must ensure that the persons in charge of the reporting unit have the “necessary proficiency”. The respective persons must therefore be at least well informed about the operations and obligations of a reporting unit, although legal expertise regarding all respective regulations is not required. Nevertheless, at least sufficient knowledge of the company’s business operations is advisable. For example, regarding internal reporting unity of a food manufacturer, knowledge of food legislation is likely to be part of the required expertise. On the other hand, sufficient expertise regarding mandatory health and safety regulations can be expected from reporting units of all employers. Therefore, it is recommended to operate the reporting unit by a specialized law firm or to provide regular training for the responsible employees in order to be able to prove this expertise.

When a report is submitted, the reporting unit has seven days to confirm its receipt. In the following step, the reporting unit should perform a validity check of the received report and verify whether the reported violation falls within the scope of the Whistleblower Protection Act. If necessary, the reporting unit will contact the whistleblower and request further information if necessary. If indications and/or evidence of the violation exist, internal investigations can be conducted and concerned persons and working units can be contacted. This may include assigning persons for an investigation, conducting document reviews, or establishing video surveillance. Alternatively, the whistleblower may be referred to the competent body or the case may be handed over to a specialized working unit responsible for internal investigations or to a competent authority. The management will carry out the necessary follow-up actions and feedback will be given to the whistleblower within the three months.

The follow-up measures may not result in disadvantages for the whistleblower. This is guaranteed by a statutory prohibition of reprisals against the whistleblower. In addition to a confidentiality requirement, protection of the whistleblower is reinforced by a reversal of the burden of proof. In the event of arising disadvantages related to the professional activity of the whistleblower, the initial draft of the Whistleblower Protection Act already provided for a reversal of the burden of proof. The same applies to the final Whistleblower Protection Act that has now been passed. However, the presumption that the disadvantage is a reprisal for the whistleblower only applies if claimed by the whistleblower himself. Due to the reversal of the burden of proof, the employer must prove that the disadvantage is based on sufficiently justified reasons or that it did not occur because of the report. In case of a violation of the prohibition of reprisals, the whistleblower can claim damages.

Co-Determination Rights of the Works Council

The co-determination rights of the works council must be observed when implementing whistleblower protection systems and obligations. If existing obligations of notice arising from the employment contract are extended and provisions regarding the specific reporting procedure are introduced, the rules of operation and the conduct of employees in the establishment are affected. In this case the works council is entitled to a right of co-determination in accordance with section 87 paragraph 1 number 1 of the Works Council Constitution Act (BetrVG). In addition, whistleblowing systems can be objectively suitable for monitoring employees if reports on the performance behaviour of other employees can be received. This would affect the co-determination right of section 87 paragraph 1 number 6 BetrVG as a matter of technical devices designed to monitor the behaviour and performance of the employees. 

How can we assist you further? We provide support in the introduction and operation of whistleblowing systems. We collaborate with providers of digital whistleblowing systems and can set up an internal reporting units. On 14 June 2023 10.00 a.m. we provide a three-hour training for case managers and other responsible persons of companies, in which the required expertise of the Whistleblower Protection Act is imparted. We are also happy to conduct in-house training. The training participants will receive a complying certificate. We can also accompany the process of introducing the whistleblower system in terms of co-determination and data protection law and provide you with the necessary documents. Please do not hesitate to contact us! Keilich@pwwl.de