Whistleblower Protection Act (HinSchG): What will change for you and your company in the future

The German Whistleblower Protection Act (“Hinweisschutzgesetz, HinSchG”) came into force on July 2, 2023. The aim of the new regulations is to protect employees in companies and other institutions from disadvantage if they pass on information about wrongdoing and potential legal violations. Such persons are also referred to as whistleblowers.

The Whistleblower Protection Act provides for the establishment of internal and external reporting offices and a ban on reprisals.

What does the Whistleblower Protection Act mean for you and your company?

1. Establishment of whistleblowing offices

Companies and organizations with 50 or more employees must install and operate secure internal whistleblower systems. Companies with 50 to 249 employees are required to have the appropriate whistleblowing systems in place until December 17, 2023; companies with more employees must implement this immediately. Companies and organizations with fewer than 50 employees that have voluntarily installed a whistleblower system must also comply with the legal requirements.

In companies with a works council, it must be taken into account that the latter has co-determination rights in the design of the whistleblower system, as the parties to the company must conclude a company agreement here.

The persons entrusted with the tasks of an internal reporting office must act independently in the performance of their duties. They may perform other tasks and duties in addition to their activities for the internal reporting office. However, it must be ensured that such tasks and duties do not lead to conflicts of interest (Section 15 (1) HinSchG).

Employers shall also ensure that the persons entrusted with the tasks of an internal reporting office have the necessary expertise (Section 15 (2) HinSchG).

2. Procedure of a report

The whistleblower has the right to choose between an internal or external reporting office. The internal report is on an equal footing with the external report.

Whistleblowers must have the opportunity to make reports verbally, in writing or in person. Anonymous reports must also be accepted.
If the whistleblower uses the internal report, the report remains within the company. In this case, the company can (initially) deal with the report and investigate the facts without interference from external bodies such as authorities.

In order for the whistleblower protection system to be accepted by your employees, the content of the report and the identities of the internal reporting office must be protected. This extends both to the whistleblowers themselves and to all other persons who are affected as a result of a report. If, on the other hand, reported violations do not fall within the scope of the Whistleblower Protection Act, the confidentiality requirement does not extend to the whistleblower. In addition, some further exceptions apply (Sections 8, 9 HinSchG).

Only the persons who receive reports or take follow-up action, as well as persons who assist in this process, are allowed to know the identity of the persons. Only these persons should have access to incoming reports.

It is also possible to set up an ombudsman reporting system.

If a report is submitted, the internal reporting office must confirm this to the whistleblower within 7 days. However, anonymous reportings are also to be followed up.

Within three months, the reporting office must inform the whistleblower of the measures taken (e.g., initiation of internal compliance investigations, forwarding of the report to a competent authority). Documentation requirements also apply.

An external reporting office exists, for example, at the Federal Office of Justice; the Länder can also set up their own reporting services.

3. Who is covered by the Whistleblower Protection Act (HinSchG)?

The Act applies to all persons who disclose information about violations in the course of their professional activities. The violations may involve tax evasion, for example. In particular, violations of EU or German law that are subject to criminal penalties or fines fall within the scope of the Act. Whistleblowers can be, for example, employees, trainees, civil servants, self-employed persons, shareholders, judges, soldiers or persons similar to employees.

Important! Reversal of burden of proof

If the identity of the whistleblower is known, his or her failure to be considered for a pending promotion, transfer or even the non-extension of a fixed-term employment contract could possibly be considered a “reprisal”. As a result, the employer must prove that the whistleblower was not discriminated against because of the report because of the reversal of the burden of proof. If this proof of exoneration is not successful, the whistleblower may be subject to fines against the company and claims for damages.

Sanctions

As with any law, penalties are provided for violations. Here, the following are some of the scenarios that may result in penalties:

• You use a reprisal against the whistleblower: up to €100,000 fine.
• You obstruct a report or subsequent communication: up to €100,000 fine.
• You attempt to obstruct a report or use reprisal: up to €100,000 fine.
• You intentionally or recklessly fail to maintain confidentiality: up to €100,000 fine.
• Despite being required to do so, you fail to ensure that an reporting office is established and operated: up to €20,000 fine.

Other violations result in fines of up to €10,000.

But whistleblowers can also be punished: If a whistleblower reports false information, he or she also faces a fine of up to €20,000.

We will be happy to advise you on the implementation of a reporting office and the associated processes.