The Whistleblower Protection Act reloaded

Bill by Germany’s Federal Ministry of Justice kicks off next round of sparring for a German law to protect whistleblowers

 

Just before Easter, on 13 April 2022, the Federal Ministry of Justice published its long-awaited Bill for a German law to protect whistleblowers (“Whistleblower Protection Bill”), which certainly contains a few surprises for companies.

With its Bill, the Ministry has taken the first step towards a German law to protect whistleblowers. The Whistleblower Protection Bill serves to implement the European Whistleblower Directive (Directive (EU) 2019/1937, “WBD”), which aims to improve protection for whistleblowers across Europe, partly by requiring companies to set up internal reporting channels. In December 2021, Germany let the deadline for implementing the WBD pass after disagreements in the last federal government. The EU Commission then initiated infringement proceedings against the Federal Republic of Germany in early 2022. The new coalition government had already announced in its pact that it wanted to implement the directive “in a legally secure and workable manner” and on time . The federal government’s Bill was therefore eagerly awaited.

While the Whistleblower Protection Bill essentially implements the provisions of the WBD consistently, in some points it deviates from or goes further than the Directive. These deviations will be of great importance in practice if the Whistleblower Protection Bill is actually passed in the present version. This article summarises the key requirements of the Whistleblower Protection Bill in corporate practice with regard to the obligation to set up internal reporting units:

1. Number of employees or field of business is the decisive criterion

The Whistleblower Protection Bill contains an obligation for the following companies to set up at least one unit for internal notifications:

• Employers that usually have at least 50 employees, section 12(2) Whistleblower Protection Bill
  
  
• Employers according to section 3(9) Whistleblower Protection Bill mean natural persons and legal entities under private law which employ at least one person
  
  
• Employees according to section 3(8) Whistleblower Protection Bill mean employees and apprentices
  
  
• The number of employees is determined by looking back at the size of the workforce to date and estimating future development (no rule focussing on a particular reference date)
  
  
• Companies in areas “prone to disruption” regardless of their number of employees (e.g. investment services enterprises or investment management companies; there is an exhaustive list in section 12(3) Whistleblower Protection Bill)
  
  

Practice note:

The Whistleblower Protection Bill contains a grace period for companies with 50-249 employees. The obligation to put in place a reporting unit will only apply to them from 17 December 2023.

Even companies with fewer than 50 employees should consider voluntarily putting in place whistleblower structures to avoid reputation-damaging external leaks (which are also protected by the Whistleblower Protection Bill).

2. Whistleblowing subjects

The internal reporting units (hotlines) must be available for at least the following types of whistleblowing:

• Infringements punishable by law, section 2(1) no. 1 Whistleblower Protection Bill
  
  
• Infringements punishable by a fine if the breached provision serves to protect life, limb and health or to protect the rights of employees or their representative bodies, section 2(1) no. 2 Whistleblower Protection Bill

• Infringements of national or European legal acts in specifically listed areas of law (e.g. in public procurement or environmental law, section 2(1) nos. 3-7 and (2) Whistleblower Protection Bill)
  
  

Practice note:

The coalition government will, as it has announced, implement the WBD by even going beyond the requirements stipulated in the WBD. While the WBD only covers infringements in certain areas of European law and politics, the scope of application of the Whistleblower Protection Bill also includes offences punishable by law and fines. This broad scope must be reflected in the subjects permitted to be reported to the whistleblowing hotlines.

3. Practical use

Companies have some room for manoeuvre regarding the group of people entitled to make whistleblowing reports:

• The internal hotline must be available to employees and temporary workers, first sentence of section 16(1) Whistleblower Protection Bill
  
  
• The internal hotline can be made available to other natural persons (such as suppliers, customers or their employees), second sentence of section 16(1) Whistleblower Protection Bill
  
  

Practice note:

Companies should consider making their hotline available to all natural persons who may obtain information on infringements within the company in the course of their work. These persons also enjoy protection from reprisals under the Whistleblower Protection Bill if they report infringements (internal or external).

4. Organisational requirements

The Whistleblower Protection Bill closely follows the requirements of the WBD as far as the organisational integration of the hotline into corporate structures is concerned. However, the Bill has a surprise in store, particularly with regard to group-wide hotlines:

• The whistleblowing hotline must be operated by an independent and competent person or department (performance of other tasks is permissible, i.e. operating the whistleblowing hotline can be one of several tasks), section 15 Whistleblower Protection Bill
  
  
• Provision of clear and easily accessible information (e.g. on the website or the intranet) on external (national) reporting channels as well as reporting units at European institutions (e.g. at OLAF, ESMA), section 13(2) Whistleblower Protection Bill
  
  
• Companies with 50-249 employees are permitted to share resources by means of a joint whistleblowing unit, section 14(1) Whistleblower Protection Bill
  
  The joint whistleblowing unit may be authorised to receive information and to take certain follow-up steps (especially clarification measures). However, each employer remains obliged to take steps to remedy the infringement and to report back to the whistleblower.

• Outsourcing the internal whistleblowing unit to third parties is permissible (e.g. ombudspersons or affiliated group companies such as the parent company; see p86 of the Whistleblower Protection Bill), section 14(1) Whistleblower Protection Bill.
  
  However, operating the hotline and taking necessary follow-up steps may not be completely outsourced to third parties (no transfer of responsibility to third parties). The original responsibility for maintaining confidentiality in handling the whistleblowing report and for remedying the infringement always remains with the obligated employer. Close coordination is therefore required between the employer and the third party, for example with regard to internal investigations and measures to remedy the grievance.
  
  

Practice note:

In the Whistleblower Protection Bill, the federal government is specifically in favour of a group privilege, i.e. group-wide whistleblowing hotlines will still be permitted. For companies, this is certainly the biggest surprise in the Whistleblower Protection Bill, because the coalition thereby deviates from the EU Commission’s interpretation of the WBD. In several statements, the EU Commission expressly rejected the recognition of group companies as “third parties”.

Given this obvious contradiction between the Whistleblower Protection Bill and the EU Commission’s view, it is advisable to ask critical questions about the admissibility of group-wide whistleblowing hotlines. Nobody knows whether this Easter present from the coalition, which companies are pleased about, will withstand scrutiny by the ECJ (and beforehand, in the ongoing legislative process).

5. Requirements regarding reporting channels

The Whistleblower Protection Bill contains mandatory procedural requirements for operating internal reporting channels:

• Maintain the confidentiality of the whistleblower and the person/people affected by the whistleblowing, section 8 Whistleblower Protection Bill
  
  
• Comply with documentation obligations including the obligation to delete the documentation two years after the conclusion of the procedure, section 11 Whistleblower Protection Bill
  
  
• Option of whistleblowing in writing or verbally, first sentence of section 16(3) Whistleblower Protection Bill
  
  
• At the whistleblower’s request, a personal meeting must be guaranteed within a reasonable time, second sentence of section 16(3) Whistleblower Protection Bill
  
  
• No obligation to allow anonymous tip-offs, third sentence of section 16(1) Whistleblower Protection Bill
  
  
• Acknowledgement of receipt of the whistleblowing report within seven days, section 17(1) no. 1 Whistleblower Protection Bill
  
  
• Tasks of the whistleblowing unit: Check the admissibility of the subject of the report and the validity of the allegations made, contact the whistleblower and, if necessary, request further information, section 17(1) nos. 2-5 Whistleblower Protection Bill
  
  
• Take follow-up measures (e.g. internal investigation, discontinuation of investigation, forward the information to authorities), section 17(1) no. 6 and section 18 Whistleblower Protection Bill
  
  
• Give feedback to whistleblowers on follow-up steps planned and already taken as well as reasons for these within three months of confirmation of receipt, section 17(2) Whistleblower Protection Bill
  
  

6. Penalties for not setting up a hotline

Section 40(2) no. 2 Whistleblower Protection Bill provides another surprise for companies. Unlike the European legislator, the federal government wants to penalise failure to set up an internal whistleblowing hotline with a fine. Accordingly, failure to set up internal reporting channels that meet the requirements of the Whistleblower Protection Bill can be punished with a fine of up to €20,000.

Practice note:

All companies that come within the scope of the Whistleblower Protection Bill’s obligation to set up whistleblowing structures should start doing so now at the very latest. This applies in particular to companies with more than 249 employees, because there is no grace period envisaged for them and the setup obligation will therefore (probably) apply as soon as the Bill becomes law. Due to Germany’s failure to implement the WBD in time, the legislative process is likely to be concluded quickly now.

In order to avoid fines, companies should pay special attention and take steps quickly.