Whistleblower Protection Act - Important for 2023

Whistleblowers are more familiar from the media or movies, but it is precisely this target group that the Whistleblower Protection Act (HinSchG) is intended to protect from sanctions, and companies are also expected to benefit from this new legislation, as the area of compliance will be given more prominence. The basis for the Whistleblower Protection Act can be the EU Whistleblower Directive (WFD), which will be adopted in 2019 and will be valid from that date. This template was used by the German legislator to develop its own law, which could be a game changer for associations, authorities and companies. For this reason, affected organizations should inform themselves in detail about the new legislation and also take the Whistleblower Protection Act as an opportunity.

The Whistleblower Protection Act will be passed soon and therefore companies with 50 or more active employees need to prepare for the new legislation. Looking at the EU Whistleblower Directive, the Whistleblower Act will require companies to implement a whistleblower system. Learn more in this blog post.

Whistleblower Directive - under which template was the Whistleblower Act developed?

The German Whistleblower Protection Act will be similar in content to the European Union Whistleblower Directive, as this is used as a template. The EU Whistleblower Directive consists of four core points, which form the basis of the legislation and will also form the basis in the national law.

1. Internal reporting channels are to be set up
2. External reporting channels are to be set up
3. Mandatory clarification of the facts at hand
4. Protection of the whistleblower and thus prohibition of reprisals

These four pillars are considered to be the minimum requirements that the German Whistleblower Protection Act must fulfill in order to be effective. For this reason, it is imperative that this basis be transformed into applicable law. It can be assumed that the Whistleblower Protection Act goes beyond this minimum standard, as the Whistleblower Directive of the European Union only refers to tips and violations of applicable EU law. Examples include environmental protection, money laundering, terrorist financing and data protection. A national whistleblower protection law should also include references that refer to violations of applicable national law. Since the governing parties have agreed in their coalition agreement, it can be assumed that reports of violations of national law and regulations will be included in the law. At the same time, reports of misconduct will be included if clarification can be shown to be in the public interest.

The National Whistleblower Protection Act

Looking at the Directive (EU) 2019/1937, it will be noted that this Directive of the European Parliament requires that an implementation of this Directive can only be carried out through national legislation. For this reason, initial attempts were launched by the Grand Coalition to define a whistleblower protection law - the first draft was subsequently prepared by the Federal Ministry of Justice and Consumer Protection. The SPD-led ministry's draft earned criticism, as glaring loopholes were discovered and some key points were listed factually incorrectly. Particular criticism was levelled at the fact that the protection of whistleblowers was excluded from the draft and that the draft thus missed its actual intention. A whistleblower protection law without the points of confidentiality, data protection, the conduct of internal searches and the protection of the persons connected with the tips was seen as incomplete. Furthermore, the Grand Coalition was rather skeptical because a whistleblower should enjoy protection for all reports, even if they were to be classified as subject to criminal penalties or fines.

From the EU Directive to the Whistleblower Protection Act - a Long Road

In order to understand the genesis of the Whistleblower Protection Act, it is necessary to look at the date of entry into force of the EU Directive. From this date, it is possible to chronicle the emergence of the national whistleblower protection law and study some interesting details.

1. December 2019 - The way for a national whistleblower protection law will be opened and thus the EU Directive 2019/1937 will come into force. What is important here is that all member states are granted two years to transform the above directive into national law and adopt a corresponding law.
2. November 2020 - After almost a year, the Federal Ministry of Justice and Consumer Protection presents a first draft, which is supposed to show an implementation of the directive and will be a first step regarding the implementation of a whistleblower protection law.
3. April 2021 - The grand coalition halts development of the Whistleblower Protection Act because the existing partners cannot agree on the scope of whistleblower protection. At the same time, they disagree and cannot agree on tasks and responsibilities.
4. December 2021 - The coalition, consisting of the SPD, FDP and Green parties, agrees on a coalition agreement that includes the plan to implement the EU directive in a legally secure and practicable manner.
5. December 2021 - No whistleblower protection law has yet been passed in the Federal Republic of Germany, although the deadline has been exceeded. Thus, the requirement from the EU Directive 2019/1937 has not been met.
6. December 2021 - There is a statement from the Federal Ministry of Justice by Federal Minister of Justice Marco Buschmann (FDP) regarding the planned Whistleblower Protection Act. Buschmann explains in an interview, which he gives to the Frankfurter Allgemeine Zeitung, that he does not consider the EU directives to be immediately applicable and for this reason the Whistleblower Protection Act should be implemented with priority. At the same time, Buschmann emphasizes that the national law should be more far-reaching than the European guidelines. The whistleblower is to be regarded as an important component and thus the whistleblower is to be safeguarded by German law.
7. December 2022 - Pressure is mounting in the Bundestag, too, and thus two members of parliament attending the simplified "Law" debate declare that the existing EU directive should be swiftly transposed into national law.
8. February 2022 -The EU Commission builds up further pressure and thus the due implementation of the Whistleblower Protection Act is officially reminded. The result is infringement proceedings against Germany, which has only a few months left to convert the EU directive into law - only prompt implementation can still protect against unwanted sanctions.
9. April 2022 - The German Federal Ministry of Justice publishes another draft of the Whistleblower Protection Act, which is entitled "Referentenentwurf eines Gesetzes für einen besseren Schutz hinweisgebender Personen sowie zur Umsetzung der Richtlinie zum Schutz von Personen, die Verstößen gegen das Unionsrecht melden" (Draft bill for better protection of whistleblowers and implementation of the Directive on the protection of persons who report infringements of Union law). This draft is also not convincing, but the federal states and associations are given the opportunity to express their opinion on the draft.
10. June 2022 - The interest in commenting is great and thus regarding the draft 50 comments from associations and societies are registered.
11. December 2022 - It is established that a whistleblower is recognized with regard to responsibility and thus no disadvantages may arise. Special protection for whistleblowers is agreed. The Whistleblower Act is passed by the Bundestag on December 16 and thus the protection for whistleblowers is to be adequately secured. 
12. February 2020 - On February 10, 2023, the Bundesrat did not initially give its approval for the new law. Now the next session remains to be seen.

The Whistleblower Protection Act in the Coalition Agreement

Looking at the content of the coalition agreement, it can be assumed that the Whistleblower Protection Act will have a very clear and legally secure content. If the present coalition agreement is viewed, the area of "entrepreneurial law" in particular should be noted and companies and whistleblowers should focus on this statement:

"We are implementing the EU Whistleblower Directive in a legally secure and practicable manner. Whistleblowers must be protected from legal disadvantages not only when reporting violations of EU law, but also significant violations of regulations or other significant misconduct whose disclosure is in the particular public interest. We want to improve the enforceability of claims for reprisals against the wrongdoer and are looking into advisory and financial support services for this purpose."

For whistleblowers who are also employees, the decisive factor is that occupational health and safety is to be monitored by the Ministry of Labor. If the concerns of companies are at stake, the Ministry of Economics will want to exert influence in order to represent the interests of the companies.

In recent years, companies have had to come to terms with a constant stream of new legislation, and the introduction of the General Data Protection Regulation in particular has shown many a company its limits. For this reason, it is important with regard to whistleblower protection to find a practicable solution that can be implemented by companies and does not create unsolvable problems.

Whistleblower Protection Act - Notifications

Looking at the core of the Whistleblower Protection Act, the protection of the whistleblower is, of course, in the foreground. The protection of the whistleblower must be defined in this law in such a way that bullying, discrimination and, of course, dismissals are ruled out. To ensure this, a reporting channel must be established in companies and institutions, for example with the help of heyDatas mattersOut. These channels are very important for organizations and companies, because these channels must be opened by the companies on their own initiative, in order to be able to follow up on the indications that arise. Companies must make sure that the reporting channels are easily accessible to every employee and that the reporting channels are actively pointed out. For companies, these reporting channels represent a clear advantage because whistleblowers do not immediately communicate a tip to an authority, but the company is informed directly through the channel provided. An employee must not misunderstand the reporting channel, as the purpose of this channel is not to hide faulty compliance from the authorities, but to provide internal clarification. This clarification allows companies to respond quickly and assess facts. A reporting channel should be seen by companies and employees as a kind of warning system that gives them the chance to increase compliance in the long term. Companies in particular will benefit from a reporting system, as grievances do not immediately become public knowledge, thus avoiding a loss of image and financial losses. At the same time, a reporting system also strengthens employees' trust in the company and shows that poor compliance can be improved in cooperation with employees.

What must a reporting channel do?

When considering a reporting channel, it should meet some minimum requirements to sufficiently comply with the Whistleblower Protection Act:

• The reporting channel may only be used internally and access must therefore be denied to unauthorized persons.
• The whistleblower must be protected by the reporting system - the identity of the whistleblower remains hidden and persons involved are also protected.
• The company must commit to providing feedback to the whistleblower. This feedback should be provided within seven days. After providing feedback, the company must inform the whistleblower within three months how the information was handled and what consequences resulted from the information.
• heyData is prepared for the new legislation and offers companies with the product mattersOut a compliance revolution that complies with the requirements of the Whistleblower Protection Act and thus offers a secure and simple communication channel that supports companies and employees in uncovering and remedying grievances.

The support of the reporting channels

In principle, a reporting channel should be professionally managed by an internal employee or by an external body. It is important here that the processing always takes place impartially and thus independently. The administrator of the reporting channel must not be influenced or manipulated by the management or by other bodies. It is to be hoped that the Whistleblower Protection Act will include examples of how to ensure the independence of a person in charge so that the work can be carried out undisturbed.

It should be noted that an internal employee who takes care of the reporting channels is never independent, as he acts as an employee of the company. If we look at the first draft law of the Grand Coalition, this dependency was not considered enough and there should only be no conflict of interest, which negatively affects tasks and duties. In this case, an independent ombudsman could provide a remedy, acting independently of the company and evaluating and processing the information externally. Commissioned lawyers or qualified management consultants could take on this role. At the same time, it is desirable that the Whistleblower Protection Act also defines and calls for existing training needs. The person responsible for the reporting channels in particular must be sensitized and supported with further training measures.

External reporting channels

The internal reporting channels must be set up independently by companies and organizations, but looking at the existing EU directive, the Whistleblower Protection Act also has the task of specifying external reporting channels. These established reporting requirements can be covered by a defined authority. If one adheres to the EU Directive, the Whistleblower Protection Act must cover and ensure the following points:

• The area of whistleblowing must be taken over by an authority that is given the competence to receive incoming reports and to provide appropriate feedback. At the same time, the authority must also be able to initiate follow-up measures. This authority will be an authorized supervisory authority.

According to the EU directive, the responsible authority must be provided with the necessary resources to ensure a smooth workflow.

If the external reporting channels are considered, the EU Directive prescribes the following requirements:

• An independent department must be created in the complex of the authority, which separates between the general information channels of the authority and the reporting channels.
• It must be ensured that all legal framework conditions are complied with. This concerns confidential processing of all information received and equally also the storage of reports and accountability in relation to the public information function of the authority.
• In principle, special whistleblowing officers must be appointed who have completed a training program. These officers are then responsible for receiving the incoming information and evaluating it in a timely manner. At the same time, those responsible have a duty to inform and must provide feedback to whistleblowers and disclose the status of the procedure. An external reporting office is planned, which will be created in the Office of Justice. This reporting office will be designated as the central point of contact and will thus be responsible for the area of whistleblowing.

How can companies make reporting channels attractive?

Employees in particular need to notice that a reporting channel offers the company certain benefits, but also improves their own work situation. To ensure this, companies should offer internal consulting services to give whistleblowing channels a positive image. In the best case, an obligation is included in the Whistleblower Protection Act that binds companies to a consulting offer. This consulting offer must make it clear to the employee how a whistleblower will be dealt with and how the further process will proceed. It is particularly important that the employee learns how his or her own protection against reprisals is defined and what the consequences of a whistleblower can be. At the same time, employees must be made aware of how the timing of the process is defined and how a whistleblower should behave if the information is to be provided anonymously.

Conclusion on the Whistleblower Protection Act

The Whistleblower Protection Act challenges companies and authorities, but also offers companies great opportunities to make internal improvements. Especially the defined processes are positive for the whistleblower and also for the company. In the past, whistleblower reports were often made public, which led to a loss of image for companies, which was often also associated with financial losses. This can be effectively prevented by an internal reporting channel. Abuses can be reported internally, giving a company the chance to make improvements before the case becomes public. Employees benefit from the Whistleblower Protection Act because they are actively involved in processes and are given a chance to report grievances without having to fear undesirable side effects. This interaction can bring about improvements within a company and also have a positive impact on employee satisfaction. In recent years, companies have had to redefine many work processes with regard to a new legal situation, and the implementation of the General Data Protection Regulation in particular was seen as a major challenge by many companies. Since employees work at the grassroots level and can quickly discover grievances regarding these new laws, a reporting channel can support a company to better implement the new requirements and uncover any gaps. For this reason, the Whistleblower Protection Act should not be seen as an additional burden, but as a real opportunity for employees, companies and organizations.