As early as December 2019, the “Whistleblower Directive” RL 2019/1937 (as it is colloquially called) was adopted at the European level. This directive aims to strengthen the protection of persons who report suspicions of possible legal violations committed by companies or authorities (“whistleblowers”). The deadline for implementation of the directive was December 17, 2021. To date, it has not yet been implemented into German law. The Federal Ministry of Justice has however published a draft bill for the Whistleblower Protection Act (HinSchG) on April 13, 2022, which is now to be adopted in the near future.
Establishment of hotlines – not mandatory but advisable
A particularly relevant question from the employer’s point of view, which already arises from the directive itself, is that of the establishment of reporting offices to which whistleblowers can turn if they believe they have identified violations of the law in companies. The directive provides for a two-track model for these reporting offices.
Article 11 of the Directive expressly requires the establishment of external reporting channels at the state level. According to the current draft bill, the federal government will establish an external reporting office at the Federal Office of Justice.
The establishment of internal reporting channels at the companies, on the other hand, is not to be made mandatory by the directive. However, the draft bill does provide for an obligation to set up an internal reporting office, depending on the size of the company. According to the draft bill, companies with more than 250 employees will have to set up a reporting office immediately, while companies with more than 50 employees will not have to do so until the end of 2023.
Requirements for reporting channels
The requirements for the possible reporting channels envisaged in the draft bill are also not insignificant. For example, reports must be possible both verbally and in text form. Whistleblowers should be able to contact internal or external bodies at their own discretion. The draft bill does not provide for any privileges for internal reporting channels.
However, we recommend all companies to provide internal reporting channels in any case, even if there is no legal obligation to do so. It should be in the interest of every company to first check any infringements internally and to be able to initiate countermeasures if necessary.
According to the draft bill, companies have various options for setting up internal hotlines:
Companies do not have to operate their internal reporting office themselves; they can also commission a third party (e.g. a law firm) to operate it.
There is no obligation to accept anonymous reports, nor is it mandatory to accept reports from persons outside the company. Nevertheless, companies may want to open the internal reporting channels to third parties and/or anonymous whistleblowers as well, as this ensures that these groups also contact the internal reporting office as a matter of priority, if necessary.
It goes without saying that companies may want to pay special attention to data protection when setting up internal hotlines. After all, it is precisely the protection of whistleblowers that is at the heart of the current legislative plans. It must be ensured that personal data of the whistleblower is not subject to access by any unauthorized third party. Finally, in the case of requests for information from data subjects, it must be ensured that the information is protected and is not to be provided with regard to the data processed within the whistleblower system.
The Whistleblower Directive is now expected to be implemented within a short period of time. We expect the Whistleblower Protection Act to be passed and enter into force before the end of 2022.
