Germany: The draft bill on the Whistleblower Protection Act – The implementation of the EU Whistleblowing Directive into national law – Obligations to act for German companies from an employment law perspective?

Who is in scope of the Act?

The draft bill covers all companies with employees in Germany. In addition, companies with at least 50 employees as well as financial service providers are required to implement internal reporting systems (see in more detail section 3). Regarding employees, the Actis applicable to all employees, trainees and personnel similar to employees. Also included are persons whose employment relationship has been terminated in the meantime or has not yet begun.

What can whistleblowers report?

According to the current draft (“WPA-Draft“), the Act is to apply to breaches of national law as well as certain EU law and its national implementation. To some extent, this exceeds the requirements of the Directive:

1. National law in this sense refers to all regulations of the Federal Republic of Germany and its Federal States that are subject to criminal penalties or fines (section 2 (1) no. 1 WPA-Draft). This applies, for instance, to regulations of the Working Time Act (sections 22, 23 ArbZG), the Personnel Leasing Act (section 16 AÜG) and the Posting of Workers Act (section 23 AEntG). This goes beyond the Directive’s requirements, which are limited to notifications of violations of Union law and national implementing acts (see b) below).
2. Union law and its national implementation means specific legal acts exhaustively listed in section 2 (1) no. 2, (2) WPA-Draft (e.g., in the field of public procurement procedure, environmental protection, road safety, consumer protection and data protection).
3. In accordance with the Whistleblowing Directive, the draft bill defines violations of these provisions not only as unlawful conduct. It also covers misuse of the law, i.e., actions and omissions that are formally lawful but are contrary to the aim or purpose of the regulations (section 3 (2) no. 2 WPA-Draft).

Internal reporting systems – which companies are in scope?

The obligation to set up an internal reporting system applies to companies who regularly employee at least 50 employees (section 12 (2) WPA-Draft). This is in accordance with the requirements of the Whistleblowing Directive. Employees, but also trainees and personnel similar to employees are to be included.

For companies with 50 to 249 employees, there is a two-year transition period until the implementation of a reporting system is mandatory (section 41 WPA-Draft). For larger companies (250+ employees), this obligation will apply as soon as the law comes into force.

Financial service providers are obliged to set up internal reporting systems irrespectively of the number of employees (section 12 (3) WPA-Draft, with further exceptions).

Internal reporting systems – what should be considered?

Internal reporting systems safeguard that whistleblowers have a point of contact within the company. The responsible body entrusted with this task records information about violations of national or EU law, which can be provided verbally, in writing or in a personal conversation (section 16 (3) WPA-Draft).

In a second step, responsible bodies check the validity of the reports and initiate so-called follow-up measures (section 13 WPA-Draft), such as conducting internal investigations. Possible follow-up measures also include the closing of the investigation (e.g., due to lack of evidence or other reasons) and the submission of the case to a competent authority (section 18 WPA-Draft). Whistleblowers will receive a confirmation of receipt of their report and of the follow-up measures taken and the reasons for them (section 17 WPA-Draft).

Internal reporting systems can be set up within the company and occupied by company employees. However, it is also possible to entrust external service providers with the performance of these tasks and have them receive and process the reports on behalf of the company. It is also possible to set up a joint reporting system for several companies with 50 to 249 employees (section 14 WPA-Draft).

The draft bill does not provide for sanctions if companies do not fulfil their obligation to implement a reporting system. However, an indirect sanction results from the fact that whistleblowers without the possibility of an internal reporting channel may turn to external systems already in the first step.

Rights of whistleblowers – no priority of internal over external reports

In principle, whistleblowers have the right to choose whether to report violations internally or to use an external reporting system (section 7 WPA-Draft). The latter is to be established at the Federal Data Protection Commissioner. In the case of violations of financial law, the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungen) (“BaFin“) serves as an external reporting office.

In limited and exceptional cases, potential whistleblowers should also have the option of contacting the public directly (e.g., via social networks or the media).

However, this reporting channel should only be protected if (1) an external report has been submitted but the whistleblower has not received any response on followup measures within a reasonable time, or (2) an external and/or internal report could exceptionally be omitted. The latter requires that the whistleblower (a) had “sufficient reason to believe” that there was an “imminent or obvious threat to the public interest” or (b) had to fear reprisals if an external report was made. Also covered are cases in which (c) there is little chance that an external reporting office would take follow-up measures (section 31 WPA-Draft).

Protection of whistleblowers – prohibition of reprisals

Whistleblowers must not be threatened with reprisals such as termination, refusal of promotion, change of assignment or disciplinary actions as a result of whistleblowing. To ensure this protection, the burden of proof is to be reversed.

Accordingly, employers must demonstrate and prove that a measure under labor law is not connected to the reporting of a grievance (section 35 (2) WPA-Draft). This protection can neither be excluded by contract nor by burdening provisions in the employment contract or collective bargaining agreement. In case of a violation of the prohibition of reprisals, whistleblowers are entitled to be compensated for damages (section 36 (1) WPA-Draft).

However, whistleblowers only benefit from this protection if the information reported is true. Otherwise, whistleblowers are only protected if they had sufficient reason to believe that this was the case at the time of their report (section 32 (1) no. 2 WPA-Draft). This requires actual grounds for suspicion. Mere speculation is not sufficient.

The draft bill nevertheless emphasizes that no excessive requirements should be demanded of the whistleblower regarding the verification of the truthfulness of a report. Persons who make mistakes in evaluating and assessing the facts and who therefore unknowingly report false information should be protected.

Persons who report false information abusively or maliciously, on the other hand, are not to be protected by the draft bill.

Whistleblower judgment of the European Court of Human Rights (ECHR)

Of importance in relation to whistleblowing is also the ECHR’s ruling dated 16 February 2021, which was made independently of the Whistleblowing Directive.

The court had to rule on a whistleblower who, while working as a doctor, had come across evidence that several patients had died as a result of morphine being given.

He suspected that the deaths were the result of active euthanasia (aktive Sterbehilfe) and reported the treating physician to the competent public prosecutor’s office.

He had not tried to investigate the case internally. Preliminary proceedings were initiated against the treating physician, which however were closed in the same year. The hospital then terminated the whistleblower without prior notice. The whistleblower’s action against the termination was unsuccessful in all instances.

The ECHR examined the termination in the context of freedom of expression under Art. 10 ECHR and declared it lawful. According to the ECHR, the whistleblower should have first tried to obtain further internal clarification. He had not made all reasonable and possible attempts to review whether the accusations were “true and reliable”.

The ECHR thus states a mandatory obligation to investigate for whistleblowers, which the Whistleblowing Directive and the draft bill do not provide for. Accordingly, whistleblowers are already protected if there are substantial indications that the reported information is true (see section 6). It remains to be seen how the upcoming Whistleblower Protection Act will be interpreted in light of the ECHR’s decision.

Prospects

With the submission of the draft bill for a Whistleblower Protection Act by the Federal Ministry of Justice and Consumer Protection, the implementation process of the Whistleblowing Directive in Germany has been initiated. It is to be expected that the legislative process will be completed within the next few months and that the formal Whistleblower Protection Act will enter into force.

Affected companies are well advised to consider the implementation of internal reporting channels or critically reviewing and, if necessary, adapting existing whistleblower systems in a timely manner in order to be optimally prepared for the legal changes as of December 2021. This also applies to the various data protection issues already raised by the Whistleblowing Directive (see our Client Alert) and which still continue in the draft bill.

We are happy to support you with our know-how and many years of experience in implementing or adapting compliance systems, including whistleblowing hotlines and other reporting channels.

Click here to access the German version: Der Referentenentwurf zum Hinweisgeberschutzgesetz: Die Umsetzung der EU Whistleblower-Richtlinie in nationales Recht – Handlungspflichten für deutsche Unternehmen aus arbeitsrechtlicher Sicht?

1 Directive (EU) 2019/1937 of the European Parliament and of the European Council of 23 October 2019 on the protection of persons who report breaches of Union law.