Bundestag passes Whistleblower Protection Act

On 16 December 2022, the Bundestag passed the Act for Better Protection of Whistleblowers (“Whistleblower Protection Act”), thus implementing the EU Whistleblower Directive and taking into account the relevant case law of the European Court of Human Rights on protecting whistleblowers. Compared to the bill in September 2022 (we reported on the March 2022 bill here, and also on the requirements for whistleblower systems here, in German only)), the enacted version of the law contains some minor changes which do not change the structure of the bill. The Whistleblower Protection Act also contains far-reaching obligations for administrative bodies and the public sector.

Key content of the Whistleblower Protection Act

The purpose of the Whistleblower Protection Act is to enable whistleblowers to straightforwardly report breaches of the law and rules in companies and public authorities and to alleviate their fears of suffering personal disadvantages. To achieve this purpose fully, the scope of application is broad and extensive organisational guidelines are laid down.

Scope

Whistleblowers within the meaning of the Whistleblower Protection Act are all natural persons who have obtained information about breaches in connection with their work or prior to their work and who report or disclose these to the reporting units listed in the Act.

In terms of the subject matter, the scope of application covers the contents of reports and disclosures listed exhaustively in section 2 of the Act. The German legislator has defined the scope of application more broadly than specified in the EU Whistleblower Protection Directive. The protected contents include, in particular, breaches that are punishable by penalty, breaches that are punishable by a fine, insofar as the provision breached serves to protect life, limb and health or to protect the rights of employees or their representative bodies, as well as breaches of national or European legal provisions in more closely defined subject areas.

Compared to the government draft, the scope of application contains two important additions. Tipoffs about anti-constitutional statements by civil servants and breaches of the provisions of the European Digital Markets Act are now covered as well.

Measures to protect whistleblowers

The core of the Whistleblower Protection Act is the obligation to set up an organisation-specific internal reporting unit and an additional external reporting unit for whistleblowers to contact as they wish. In principle, every private-sector and public-sector employer must set up and run an internal reporting unit. Only employers with fewer than 50 employees are exempt. The central external reporting unit is (with specific exceptions) a unit set up for this purpose at the Federal Justice Office (BfJ) and organisationally separate from the rest of the BfJ’s area of responsibility, as well as, optionally, reporting units set up in the federal states which concern the state and municipal administrative bodies. In addition, the Federal Financial Supervisory Authority (BaFin) and the Federal Cartel Office (Bundeskartellamt) have set up external reporting units for certain offences within the remit of these authorities. Both internal and external reporting units have to provide appropriate reporting channels, check the validity of the report and take appropriate follow-up measures. Follow-up measures may include, in particular, internal investigations at the employer’s premises, but may also include dismissal of the case due to lack of evidence.

As a major deviation in practice from the original bill, it is now obligatory for reporting units to also deal with anonymous tipoffs and to provide suitable reporting channels that allow for anonymous communication between whistleblowers and reporting units. In the bill, this was only envisaged for standard cases (“ought to” rather than “must”). However, the procedure for receiving such anonymous tipoffs will not be mandatory until 1 January 2025.

To avoid whistleblowers suffering disadvantages as a consequence of their (justified) tipoff, reprisals against whistleblowers are prohibited. To facilitate enforcement of this, it is presumed, as a reversal of the burden of proof, that any professional disadvantage that occurs after a report is a reprisal. A breach of the prohibition constitutes an administrative offence subject to a fine of up to €100,000. As a further legal consequence of a breach, a whistleblower can demand financial compensation for material and also – in derogation from the bill – for intangible damages.

Obligations for administrative bodies and the public sector

The Whistleblower Protection Act is not only a challenge for private-sector companies, but also requires particular action both in government bodies and public-sector enterprises.

To start with, public-sector employers are also required to set up an internal reporting unit. The following applies: If the employer is the federal government or a state government, the supreme federal or state authorities must establish organisational units consisting of individual or several authorities, administrative units, companies or courts, each of which must set up an internal reporting unit. This obligation also applies to municipalities and associations of municipalities in accordance with the relevant state law, as well as companies owned or controlled by them (the adopted version of the Act explicitly clarifies this compared to the bill). This also puts municipal companies (such as public utilities and local transport companies) under pressure to act. Adjustments by the legal committee, based on proposals by the Association of Municipal Enterprises, clarified that municipal enterprises can set up joint reporting units. Otherwise they would have been in a worse position than private-sector companies, which also have this option.

In order for the internal reporting units to perform their tasks, they must be given the necessary powers to do so. In addition, the people entrusted with these tasks must be able to carry out their activities independently. When specifically structuring the internal reporting units, public authorities in particular will have to consider how to ensure independent fulfilment of tasks despite the fact that state officials are fundamentally bound by instructions and despite the hierarchical administrative structure. In addition, the special provisions of the Whistleblower Protection Act on the protection of state secrecy interests must be observed.

The requirements of the Whistleblower Protection Act for public-sector employers are not only to be seen as an obligation. They can also be understood as a means of ensuring the administrative apparatus complies with the law and the constitution. This type of protection is clearly reflected in the example of anti-constitutional statements by civil servants, which are now included in the scope of protection as a suitable subject for reporting or disclosure. According to the explanatory memorandum of the Bundestag’s legal committee, the specific reason for this amendment is the current discussion on how to deal with far-right “Reichsbürger” in the civil service. For example, if a civil servant denies the existence of the Federal Republic of Germany and rejects the free democratic basic order, that will be considered a statement in breach of the constitution.