After a long wait: The Whistleblower Protection Act finally came into force on 2 July 2023. This is what Employers need to know now.
In 2019, the European Union (EU) adopted the European Whistleblower Directive (WBD). The WBD provides a deadline for the national implementation until 17 December 2021, which, however, has not been met in Germany as well as in many other EU member states.
At last, after a long waiting time, the Whistleblower Protection Act (German: “Hinweisgeberschutzgesetz”, short form: “HinSchG”) came into force on 2 July 2023.
In comparison to the original draft, the Whistleblower Protection Act provides the following changes:
1. The scope of application of the Whistleblower Protection Act is limited to information from the professional context. Only whistleblowers who have obtained information about violations in connection with their professional activity or in the run-up to a professional activity are covered by the Act.
2. No obligation to allow the submission of anonymous reports.
3. The maximum amount of fines for violations was reduced from EUR 100,000 to EUR 50,000.
The following companies are obliged to implement a whistleblower procedure:
Company size | Obligation to establish internal report centres |
Less than 50 employees |
No obligation |
Between 50 an 249 employees |
Internal report centre as of 17 December 2023 |
More than 250 employees |
Internal report centre as of 2 July 2023 |
In addition, secure internal report centres for whistleblowers must be available throughout the EU in public sector institutions, public authorities and municipalities with a population of 10,000 or more.
Not only employees who report wrongdoings are protected, but also applicants, former employees, supporters of the whistleblower and journalists.
Whisteblower protection covers reports of wrongdoings in relation to national and EU law, such as tax fraud, money laundering or offences related to public procurement, environmental protection etc. It is required that the report violation relates to the employer or another entity with professional contact to the whistleblower.
Specifically, whistleblowers have to be protected from reprisals (e.g. dismissal, demotion, intimidation, mobbing or other types of attacks) or threats of reprisals based on their report.
Furthermore, there is a reversal of the burden of proof: employers must prove that there is no causal link between the reprisal and the whistleblowing. However, the whistleblower must claim that the discrimination is a reprisal for the whistleblowing.
The following requirements must be met by the report centres:
The report centres must be independent. In order to achieve this independence, the report centres must be staffed by at least one employee and and one external person.
In terms of skills, the selected persons must have the necessary expertise, for example through appropriate training. The employees of the internal reporting office must know about the function, competences and independence of the reporting office as well as about the factual scope of whistleblower protection and the confidentiality requirement. Legal training is not required, but of course, it is not harmful either.
There can be written, verbal or electronic reports, e.g. by telephone, as well as the use of a whistleblowing portal.
Whistleblower can decide whether to use the internal or the external reporting channel. An external report centre will be established at the Federal Office of Justice. However, the use of internal report centres is preferred by the Whistleblower Protection Act.
If a report is submitted by a whistleblower, the following processing deadlines must be observed by the employer:
Type of violation | Fine |
|
Up to EUR 50,000 |
|
Up to EUR 20,000 |
Other violations |
Up to EUR 10,000 |
If your company has more than 50 employees, you should urgently check whether your existing internal processes comply with the requirements of the Whisteblower Protection Act and whether the principles established by case law are observed.
In particular, companies with more than 250 employees should act immediately because the law came into force on 2 July 2023. Since then, they must have set up a reporting system that complies with the law. Otherwise, they could face fines of up to EUR 20,000.