No end to the stalemate: Whistleblower Protection Act fails to pass in the Bundesrat

The Bundesrat (Upper House of the German legislature) today refused to give its consent to the draft bill of a German protection law submitted by the coalition government consisting of the Social Democrats, the Greens and the Liberal Democrats (known as the “traffic-light coalition”). It seems that the struggle for a German Whistleblower Protection Act will now shift to parliament’s cross-party mediation committee!

It is now official: we will not have a German Whistleblower Protection Act by mid-2023 either. The transposition into German law of the European Whistleblower Directive (2019/1937/EU, the “Directive”) failed ‒ not all that surprisingly ‒ today in the Bundesrat. This leaves companies and whistleblowers for the time being in an unclear legal position. Once again it is not a good day for Germany as a member state of the EU ‒ quite rightly, the EU Commission is now conducting infringement proceedings against Germany for its failure to implement the Directive.

Following the Federal Government’s renewed attempt to enact a law protecting whistleblowers in its ministerial draft bill in April 2022 (cf. our article “The Whistleblower Protection Act reloaded”), it published its governmental draft in July 2022. On 16 December 2022, with the votes of members of the traffic-light coalition, the German Bundestag finally voted in favour of the Whistleblower Protection Bill (records of the Bundestag 20/3442 and records of the Bundestag 20/4909, the “Whistleblower Protection Bill”), which was debated in today’s session of the Bundesrat.

The adoption of the implementing law is relevant for companies because, in addition to a high level of protection for whistleblowers, it will also provide for the mandatory establishment of internal reporting channels in accordance with the provisions of the Directive (cf. also our series of articles on the Directive). The traffic-light coalition’s Whistleblower Protection Bill sets forth, among others, the following provisions, which in part go even beyond the minimum requirements of the Directive:

• Companies with 50 or more employees are as a rule required to  establish and operate internal reporting channels  , section 12 of the Whistleblower Protection Bill.

• Internal reporting channels must be available for reporting the following matters:
  
  
• Infringements punishable by law , section 2(1), no. 1 of the Whistleblower Protection Bill
• Infringements punishable by a fine if the breached provision serves to protect life, limb or health or to protect the rights of employees or their representative bodies, section 2(1), no. 2 of the Whistleblower Protection Bill
• Infringements of national or European legal acts in specifically listed areas of law (e.g. in public procurement or environmental law, section 2(1), nos. 3-9 and (2) of the Whistleblower Protection Bill
• Statements by civil servants that constitute a violation of the duty to be loyal to the constitution, section 2(1), no. 10 of the Whistleblower Protection Bill

• Internal reporting channels must be available in particular to employees and temporary workers ; companies may decide whether the reporting channels should also be available to third parties who are in contact with the company, section 16(1) of the Whistleblower Protection Bill
  
  
• Outsourcing the internal reporting channel to third parties is permissible (e.g. to affiliated group companies such as the parent company) because “according to the separate legal personality principle that applies to companies […], an independent and confidential unit can also be [established] as a “third party” at another group company (e.g. parent company, affiliated company or subsidiary]” (see p. 79 of the explanatory notes to the Whistleblower Protection Bill)
• As from 1 January 2025, companies will have a duty to establish  anonymous reporting, section 16(1), sentences 4-6 and section 42(2) of the Whistleblower Protection Bill

• Protection for whistleblowers against retaliation (such as dismissal)
  
  
  • Whistleblowers are protected even where they make a false report due to “simple” negligence, section 33(1) of the Whistleblower Protection Bill
  • The motive of the whistleblower is irrelevant (p. 92 of the explanatory notes to the Whistleblower Protection Bill)
  • Whistleblowers may choose whether to make a report internally or externally, section 7(1) and section 33(1), no. 1 of the Whistleblower Protection Bill
  • The draft bill reverses the burden of proof in favour of the employee so that it is for the employer to prove that the whistleblowing report did not cause the discrimination alleged by the employee, section 36(2) of the Whistleblower Protection Bill.

• Penalties
  
  
• Section 40(2), no. 2 of the Whistleblower Protection Bill imposes penalties of up to € 20,000 for failure to set up internal reporting channels
• For retaliation against a whistelblower, companies may be fined up to €1 million, section 40(2), no. 3 and section 20(6) of the Whistleblower Protection Bill in conjunction with section 30(2), sentence 3 of the Administrative Offences Act

The federal states that are governed by the Union parties CDU/CSU rejected the Whistleblower Protection Bill during today’s session of the Bundesrat. Their main points of criticism were, in addition to the additional bureaucratic burden for companies that the establishment of internal reporting channels would cause, the extension of the Whistleblower Protection Bill’s material scope of application beyond that which is required by European law as well as the obligation to establish anonymous reporting procedures, which the Bundestag had included in the draft bill at the last minute.

During the previous legislative period, there had already been heated debate about the extension of the German Whistleblower Protection Bill’s material scope of application. Ultimately, this is actually why the legislative process failed. In the meantime, the CDU/CSU is the only one of the German political parties to reject implementation of the Directive in a manner exceeding its requirements. However, due to the party-political balance of power in the Bundesrat, agreement on this is essential. As was to be expected, this question therefore remains the “dealbreaker” as far as the adoption of a German law to protect whistleblowers is concerned.

The main victims of this political stalemate over the implementation of the Directive in Germany are ultimately the companies and the whistleblowers, who will have to deal with an unclear legal situation in the coming months. Irrespective of this, all companies that the Whistleblower Protection Bill subjects to an obligation to establish a whistleblower system should consider doing so now at the latest. Sooner or later, such an obligation will be introduced!