The German Federal Ministry of Justice recently followed up on the announcements made in the "traffic light" coalition agreement by reissuing the overdue draft of a whistleblower protection law. We answer the most important questions in connection with this draft law, which has been updated in its second version, and highlight in particular the main changes compared to the previous version - from the now stricter sanctions to new possibilities for flexibility.

What is the status quo?

The draft of the Whistleblower Protection Act (HinSchG) has been prepared by the Federal Department of Justice and is now being coordinated by the government departments. Last year, a draft was presented under the Grand Coalition, which we have already presented to you in detail(see blog: The EU Whistleblowing Directive). However, due to various discrepancies, it was not possible to finally implement the bill by the end of the last legislative period in the fall of 2021 (see blog: Is your company adequately prepared for the EU Whistleblowing Directive?).

The HinSchG is intended to transpose the requirements of EU Directive 2019/1937 into national law and thus establish a uniform level of protection for whistleblowers. As this should already have been done within an implementation deadline of December 17, 2021 provided for in the Directive, the EU Commission even initiated infringement proceedings against Germany at the beginning of the year.

What remains the same?

In addition to core elements such as comprehensive protection of whistleblowers against all reprisals (such as dismissal, but also any other unequal treatment in connection with the report), including a reversal of the burden of proof in labor court proceedings, the new draft retains the fundamental freedom of choice for whistleblowers: Whether a report is made internally to the body set up by the company or externally to the body now set up at the Federal Department of Justice rather than the Federal Data Protection Commissioner is to be left solely to the decision of the person making the report. Furthermore, immediate disclosure to the public will continue to be possible only in exceptional cases.

The personal scope of application continues to include all persons who have obtained information about violations in their professional environment (i.e. not only employees). No stricter limits are set with regard to the principles for the establishment of internal reporting offices either, and in this respect the requirements of the Directive are followed. Initially, only employers with at least 250 employees are obliged to set up corresponding channels. Only from December 17, 2023 will this also apply to companies with at least 50 employees.

Sharing of a central whistleblowing reporting channel

For the latter employers, who are regularly medium-sized companies, the draft provides for a further simplification and enables the cross-company joint use of resources within the framework of the establishment of so-called "joint reporting channels".

The explanatory memorandum to the draft now expressly provides for such cross-company use within the group as well. Last June, the EU Commission announced that the directive should be interpreted as requiring separate reporting channels to be set up for each individual group company (see blog: Is your company adequately prepared for the EU Whistleblowing Directive?). Contrary to this view and the corresponding implementation laws of other EU member states, the draft bill now allows more flexibility here and permits recourse to reporting systems made available centrally, e.g. at a group parent company.

However, in the case of joint access to central reporting channels, verification and clarification of the reports must be carried out locally or decentrally.

What other changes does the new draft bring?

While the previous draft still named all violations subject to criminal penalties and fines as possible reportable offenses, the new draft limits reports to regulatory offenses that serve to protect life, limb or health or to protect the rights of employees or their representative bodies (such as works councils). Regulations in the field of occupational health and safety are explicitly mentioned in the explanatory memorandum to the draft. In addition, there are further regulations listed in detail in the text of the draft, most of which originate from European law (including regulations in the area of environmental protection, product safety or data protection).

Due to this classification of different types of violations, it remains challenging for employers to implement this specific whistleblower protection accordingly. For this reason, companies should consider whether it makes sense to open up the reporting channels beyond the clearly defined catalog of regulations that can be reported.

What sanctions do employers face?

While the previous draft was based on the corresponding framework of the Directive and did not provide for sanctions for employers who fail to set up an internal reporting office, the new version of the draft sets different standards.

In addition to unlawful reprisals and a breach of confidentiality with regard to the identity of whistleblowers, it is now expressly punishable as an administrative offense if whistleblowers prevent or obstruct reports or communication with whistleblowers, or if they fail to set up and operate internal reporting offices.

In addition, the range of fines has been tightened and now allows sanctions against companies of up to EUR 1,000,000. The violation of the obligation to establish and operate an internal reporting system can be sanctioned with up to EUR 20,000.

Does the anonymity of the whistleblower have to be ensured?

Also according to the new HinSchG draft, employers are not obliged to provide internal reporting channels in such a way that the anonymity of whistleblowers is protected.

However, it should still be taken into account that ensuring anonymous internal reporting can significantly improve acceptance of and trust in the company's internal whistleblowing system. Although the likelihood of unsubstantiated denunciations could equally increase, employers should at least seriously consider the incentive effect of anonymous internal reporting as part of an attractive design of their own channels. The more attractive internal reporting systems are, the less motivated employees are likely to be to turn to external channels right from the start.

What are the next steps?

Once the government departments have agreed, the next step is for the associations (employers' associations and trade unions alike) to be involved. The approval of the Bundesrat is also required. In principle, the aim - at least politically - is for the law to enter into force soon after the parliamentary summer recess and thus probably in the fall.

What should I do as an employer now?

Even though there may still be changes in the further course of legislation, employers are well advised to start dealing with this issue now - especially if they have not yet set up a whistleblowing system. But even employers who already have a whistleblowing channel in place should quickly begin to review it in light of the new requirements. An attractive design of the internal reporting channels will be of particular importance in order to provide a clear incentive for internal reports and to prevent a possible loss of reputation.

In addition to the technical requirements, other legal framework conditions beyond the regulations in the HinSchG should also be taken into account at an early stage, such as data protection requirements or existing co-determination rights of the works council.