New attempt to transpose the EU Whistleblower Directive

On 17 December 2021 Germany allowed the deadline for transposing the EU Whistleblower Directive (Directive (EU) 2019/1937), which entered into force on 16 December 2019, into national law to expire. This was followed by Germany receiving a "blue letter" from Brussels and with it the initiation of infringement proceedings by the EU Commission against Germany and other EU Member States. Neither the previous nor the current German government could agree on a Whistleblower Protection Act (HinSchG). On 13 April 2022 the Federal Ministry of Justice then presented its draft of a such law.

I. The current draft of a Whistleblower Protection Act

The most important content of the draft is summarised below:

1. Obligation to establish an internal reporting office (Meldestelle) (section 12 draft German Whistleblower Protection Act) Implementing the provisions of the Directive, the draft provides for certain employers (Beschäftigungsgeber) to establish internal reporting offices as mandatory. All natural persons as well as legal persons under public and private law, partnerships with legal capacity and other associations of persons with legal capacity are deemed to be employers in this sense (see section 3 (9) draft German Whistleblower Protection Act). This means that all private companies are being addressed, in particular. The reporting offices in detail:
   1. Persons to whom the obligation applies
   2. Employers which normally employ at least 50 workers must establish and operate at least one internal reporting office.[1] Workers in this context especially include employees and those employed for vocational training purposes (section 3 (8) draft German Whistleblower Protection Act).
   3. Certain employers (e.g. investment service providers, credit and financial services companies) listed exhaustively in section 12 (3) draft German Whistleblower Protection Act must establish an internal reporting office regardless of the number of workers they employ.
   4. If an internal reporting office is not established and operated contrary to the obligation provided for, the new draft qualifies this as an administrative offence which can be punished with a fine of up to EUR 20,000.00 (section 40 (2) no. 2 in conjunction with (5) draft German Whistleblower Protection Act).
   5. It may be advisable for employers which employ fewer than 50 workers to voluntarily establish an internal reporting office in order to minimise the risk of external reports (see under 4).
   6. Ways of establishing an internal reporting office
   7. There are various ways in which the employer can establish an internal reporting office.
   • An employer may entrust a worker, a group of workers (work unit) or even a third party with the tasks of an internal reporting office (section 14 (1) sentence 1 draft German Whistleblower Protection Act).
   • Several private employers which normally employ between 50 and 249 workers each may establish and operate a joint internal reporting office (section 14 (2) sentence 1 draft German Whistleblower Protection Act). This possibility of being able to share resources is also provided for in Article 8 (6) EU Whistleblower Directive. This is intended to prevent economic overburdening, especially in the case of smaller enterprises. It should be noted, however, that even in cases where resources are shared, the obligation to give feedback after reviewing the report received remains with the individual employer (section 17 (2) draft German Whistleblower Protection Act, more on this under 3 b). In addition, the individual employer remains under an obligation to take measures to remedy the breach (section 14 (1) sentence 2 draft German Whistleblower Protection Act).
   As soon as the employer has decided on the type of reporting office to be established, it is the employer's responsibility, when selecting the person or department, to ensure that the appointed person or group of persons has the necessary expertise to properly perform the tasks (section 15 (2) draft German Whistleblower Protection Act). For the further requirements relating to internal reporting bodies, see under 2.
2. Implementation deadlines
3. For employers which normally employ between 50 and 249 workers, there is a transitional arrangement according to which the internal reporting office does not have to be introduced until 17 December 2023 (section 42 draft German Whistleblower Protection Act).
4. Since the draft does not provide for a comparable grace period for all companies which normally employ more than 249 workers, it is necessary to presume that the obligation to establish internal reporting offices will apply to them immediately when the Act comes into force. This also applies to those employers within the meaning of section 12 (3) draft German Whistleblower Protection Act which are subject to an obligation to establish an internal reporting office regardless of the number of workers.

• Internal reporting offices – requirements

The draft German Whistleblower Protection Act contains a large number of provisions on the design of internal reporting offices.

First, the reporting office must be operated by an independent person or department with the required expertise (section 15 draft German Whistleblower Protection Act). Furthermore, it must provide clear and easily accessible information for workers on external reporting procedures and relevant reporting procedures of European Union bodies, institutions or other agencies (section 13 (2) draft German Whistleblower Protection Act).

In terms of content, the internal reporting offices must definitely be available for the reporting of criminal offences, offences punishable by fines and other breaches of the German and European legal provisions mentioned in section 2 (1) no. 3 draft German Whistleblower Protection Act.

In this connection both workers and temporary agency workers must have access to the internal reporting office (section 16 (1) sentence 1 draft German Whistleblower Protection Act). Other persons may also be granted access.

The following must be taken into account with regard to the proper design of the internal reporting office:

• Only the persons responsible for receiving and processing the reports as well as the persons assisting them in performing these tasks may have access to the incoming reports (section 16 (2) draft German Whistleblower Protection Act).
• It must be possible to make reports in writing or orally. In this connection it must be possible to make oral reports by telephone or other means of voice transmission. At the request of the reporting person, it must be possible for a meeting in person for the purpose of reporting the information to be held within a reasonable period of time (see section 16 (3) draft German Whistleblower Protection Act).
• There is no requirement to make anonymous reporting possible (section 16 (1) sentence 4 draft German Whistleblower Protection Act).
• Receipt of the report must be confirmed within seven days at the latest (section 17 (1) no. 1 draft German Whistleblower Protection Act).
• The reporting office must check the admissibility of the subject of the report and the accuracy of the allegations made, maintain contact with the reporting person and request further information where necessary, section 17 (1) nos. 2-5 draft German Whistleblower Protection Act.
• The internal reporting office will also take follow-up measures (e.g. internal investigations), section 17 (1) no. 6, section 18 draft German Whistleblower Protection Act – where appropriate.
• Finally, the reporting office must notify the reporting person of action envisaged or follow-up measures taken and the reasons for choosing such action or measures within three months of confirmation of receipt, section 17 (2) draft German Whistleblower Protection Act.

• Dealing with reports (compliance management)

When receiving information the reporting offices must observe various procedural principles and duties of conduct. In the event of a breach, the relevant employers can be fined up to EUR 100,000, depending on the provision breached; see, in particular, section 40 draft German Whistleblower Protection Act.

In order to ensure the protection of reporting persons, the reporting offices are subject to the following obligations in particular:

1. Confidentiality
2. The guiding principle of whistleblower protection is confidentiality. The first procedural principle (section 8 draft German Whistleblower Protection Act) therefore stipulates that reporting offices must treat the identity of both the reporting persons and persons who are the subject of the report as well as other persons named in the report confidentially. Exceptions from this very broadly worded confidentiality requirement are only possible in the cases listed in section 9 draft German Whistleblower Protection Act. Such cases may, for example, be where incorrect information is provided with intent or gross negligence; in criminal proceedings at the request of the criminal prosecution authorities; if the disclosure is necessary for follow-up measures or where the reporting person has consented to this.
3. Data protection law requirement
4. The reporting offices to be established inevitably process personal data. Pursuant to section 10 draft German Whistleblower Protection Act, they are only authorised to do so to the extent that this is necessary for performance of their tasks.
5. Documentation obligation
6. Reports received by the reporting office must be documented in a permanently retrievable manner in compliance with the confidentiality requirement (section 11 (1) draft German Whistleblower Protection Act).
7. Audio recordings of reports made by telephone may only be made with the consent of the reporting person. The same applies to written transcripts that reproduce the telephone conversation in full. In the absence of such consent, a summary of the content of the report must be made by the person receiving the report (record of the content).
8. For the documentation of a report made in the context of a meeting in person, it is also the case that a complete and accurate record of the meeting may only be made and kept (e.g. audio recording or written transcript) with the consent of the reporting person.
9. The reporting person must be given the opportunity to check the record or transcript, to correct it if necessary and to confirm it by way of their signature.
10. The documentation must be deleted two years after the end of the procedure.

• External reporting offices

In future reporting persons are not only intended to have access to internal reporting offices of the respective employer. These are to be supplemented by publicly organised "external reporting offices". This is particularly important for reporting persons whose employers are not required to establish an internal reporting office due to their size – other reporting persons may, however, also choose to contact the external reporting office.

1. Types of external reporting offices
2. Sections 19 ff. draft German Whistleblower Protection Act provide for the establishment of various external reporting offices at national and federal state level.
3. Tasks of the external reporting offices
4. The external reporting bodies have several tasks beyond receiving information. For example, they offer comprehensive and independent information and advice on existing remedies and procedures for protection against retaliation measures to natural persons considering making a report, section 24 (2) sentence 1 draft German Whistleblower Protection Act. They are also responsible, for example, for providing general information on the internet (e.g. on the requirements for whistleblower protection; explanations of reporting procedures and the possible follow-up measures; confidentiality regulations and data protection).
5. For the proper design of the external reporting office, similar compliance requirements apply as to the design of internal reporting offices (see under 2.). The external reporting offices do not have a duty to check anonymous reports, section 27 (1) sentence 3 draft German Whistleblower Protection Act. It must be possible for reports to be received both orally and in text form (section 126b German Civil Code (BGB)). At the request of the reporting person, it must be possible for them to attend a meeting in person within a reasonable period of time (see section 27 (3) draft German Whistleblower Protection Act).

• Disclosure

Only subject to certain conditions do reporting persons have the right to make information about breaches available to the public. The requirements for such "disclosures" are set out in the third chapter (sections 32 ff. draft German Whistleblower Protection Act) of the draft. Disclosing incorrect information about breaches is, of course, prohibited, section 32 (2) draft German Whistleblower Protection Act.

• Possible subjects of reports

The draft German Whistleblower Protection Act allows reporting persons to report information about breaches (see section 7 (1) draft German Whistleblower Protection Act). Breaches are acts or omissions in the course of professional, commercial or official activities that are unlawful or abusive.

Under the draft, reporting persons can firstly report breaches of the legal acts of the European Union together with their national transposition laws specified by the EU Whistleblower Directive as a minimum scope. These concern, among other things, data protection law, consumer protection, environmental and animal protection, public procurement law or financial supervisory law. In addition, the Act includes all laws, statutory instruments and other legal provisions of the German government and the federal states that fall within these areas of law. Even more far-reaching is the inclusion of information on breaches that are subject to criminal penalties or fines. The latter, however, only insofar as the provision breached serves to protect life, limb or health or to protect the rights of workers or their representative bodies. The draft goes beyond the requirements of the Directive in terms of its material scope of application pursuant to section 2 draft German Whistleblower Protection Act.

According to the explanatory notes on the legislation, a reporting person should not be able to report unethical or immoral behaviour, however. Personal conflicts between employees or with their superiors do not fall within the scope of the German Whistleblower Protection Act as a matter of principle provided that the conduct triggering the conflict is not punishable by law or, with the restrictions described above, does not constitute an administrative offence. Purely private misconduct is not intended to be reportable either.

The reported information must at least be based on reasonable suspicion. Such suspicion may relate to breaches already committed. However, it is also sufficient for the suspicion to merely refer to a (future) breach that is very likely to occur. The draft German Whistleblower Protection Act therefore allows for very far-reaching reports. The draft does not yet regulate the individual requirements for reasonable suspicion.

• Requirements relating to the report/disclosure

1. Information being true not a prerequisite for the notification/disclosure to be lawful
2. If the reporting person decides to report their information on breaches, they must have sufficient grounds to believe that the information is true at the time of the report or disclosure (section 33 (1) no. 2 draft German Whistleblower Protection Act). It is necessary and at the same time sufficient for the reporting person to have good faith that there is a breach in factual or legal terms. By contrast, section 33 draft German Whistleblower Protection Act does not require the information to actually be true. It only provides for intentional or grossly negligent false reports by the reporting person to not be protected.
3. Neither the draft German Whistleblower Protection Act – nor the Directive – regulates which specific duties of care and investigation are incumbent on the reporting person with regard to the truth of their report. The decisive factor is likely to be that they were entitled to believe the information to be true on the basis of their individual personal knowledge and abilities.
4. In particular, it is likely to be necessary for the reporting person to evaluate the information available to them before making a report. The draft German Whistleblower Protection Act does not provide for any further investigation obligations.
5. Motives of the reporting person also irrelevant
6. The reporting person's motives for making the report do not play a role in the protection of the reporting person. For this reason, it is irrelevant (deviating from the case law of the German Federal Labour Court on the legal situation up until now) whether the reporting person passes on their information for honourable reasons or makes their report or disclosure out of envy, ill-will, revenge or jealousy. Even reports or disclosures with intent to harm are intended to be covered by the new German Whistleblower Protection Act as long as the reporting person satisfies the other requirements for the report or disclosure.
7. Right to choose between making an internal or external report
8. If the reporting person decides to pass on their information, they have the right to choose whether to make an internal or an external report. This was highly controversial within the framework of the Directive and ought to now be finally clarified with the clear provision in section 7 (1) draft German Whistleblower Protection Act. In the case of an external report, however, it is provided that the authority must in "suitable cases" inform the reporting person of the possibility of making an internal report. If the reporting person initially makes an internal report, they can turn to an external reporting office if their internal report has not led to remedy of the breach. This suggests that, under the provisions of the draft Whistleblower Protection Act, the reporting person must wait for the outcome of an internal report before making an external report.
9. Disclosure as a last resort
10. In addition to internal and external reporting, the draft provides for what it refers to as disclosure (section 32 draft German Whistleblower Protection Act). This refers to the publication of the information on breaches, e.g. in classic print media or on social media. Unlike with internal and external reporting, the reporting person does not have a right to choose with regard to whether or not to disclose their information. If they wish to disclose their information, the draft Whistleblower Protection Act requires that the reporting person first make an unsuccessful external report.
11. As a rule, they can therefore only make a disclosure if no appropriate follow-up measures have been taken to clarify the breach in response to their external report within the time limits for feedback (normally three months after the external report, section 28 (4) draft Whistleblower Protection Act) or if they have not received any feedback. Only in exceptional cases can they also disclose their information directly, for example if the breach may pose an immediate and obvious risk to the public interest because of an emergency or if retaliation measures must be feared if an external report is made.
12. Due to the threat of reputational damage caused by the disclosure, companies are therefore well advised to have attractive internal reporting channels available and to consistently process any reports they receive.

• Protection of reporting persons/persons concerned

1. Protected conduct of the reporting person
2. If the reporting person meets the requirements for reporting or disclosure, they are protected by the German Whistleblower Protection Act. Firstly, they are protected when reporting or disclosing their information. Furthermore, section 35 (1) draft German Whistleblower Protection Act provides for the reporting person to also not be able to be held legally responsible for obtaining or accessing information that they have reported or disclosed. This applies at least in cases where the obtaining or accessing of the information does not constitute a criminal offence in its own right. In this respect, the German Whistleblower Protection Act denies a "safe harbour" for criminal offences of obtaining information from the outset.
3. This means that reporting persons who commit, for example, trespass or hacking while obtaining information can be prosecuted for this act, but not for reporting or disclosing the information.
4. Protection from retaliation measures
5. Retaliation measures directed against reporting persons are prohibited under section 36 (1) draft German Whistleblower Protection Act. The prohibition also applies to the mere attempt at retaliation measures. The reporting person may therefore not suffer any unjustified disadvantages in connection with their report or disclosure.
6. The draft therefore prohibits any conceivable form of discrimination on the basis of a lawful report or disclosure. It therefore also grants the reporting person protection against dismissal on the basis of their report or disclosure, regardless of whether the German Protection Against Dismissal Act (KSchG) applies. Furthermore, the prohibition also covers the reporting person being released from the obligation to work (garden leave), their employment contract not being made permanent, a promotion not being awarded, a bad reference or mobbing. This enumeration makes it clear that in future employers may be subject to increased pressure to give reasons even for seemingly neutral actions such as not promoting a reporting person. In cases where a report has been made, this even applies to terminations during the probationary period, for which objective reasons are not otherwise required.
7. In addition, the reporting person has a right to compensation if they suffer retaliation measures (section 37 draft German Whistleblower Protection Act). As under the German General Act on Equal Treatment (AGG), however, there is not intended to be a right to the establishment of an employment relationship or to a promotion.
8. The protection of reporting persons is additionally flanked by provisions on fines: anyone taking retaliation measures against the reporting person is acting in breach of the law and can be fined up to EUR 100,000.
9. Protection in proceedings by way of a reversal of the burden of proof
10. If the reporting person takes court action against a retaliation measure, for example in the context of unfair dismissal proceedings, they also benefit from reversal of the burden of proof which is provided for by section 36 (2) draft German Whistleblower Protection Act. If they suffer a disadvantage during a period of time connected with a report, it is presumed that this disadvantage is a retaliation measure. In other words, there is a presumption that the disadvantage is a prohibited reaction to the report or disclosure. It is then up to the employer to prove that the measure was based on sufficiently justified grounds or was definitely not a result of the report.
11. This reversal of the burden of proof is intended to help reporting persons overcome the problem that they often find it difficult to prove causation between a lawful report and, for example, a dismissal. For employers, however, this means that they must document reasons for disadvantageous measures such as dismissals even more carefully than they already have to do now.

II. Effect of the non-transposed EU Whistleblower Directive after expiry of the transposition deadline

The EU Directive should already have been transposed in Germany by 17 December 2021. The now unregulated state of affairs raises the question of whether and to what extent the Directive already has legal effect.

1. Public sector employers
2. According to the case law of the CJEU, once the transposition deadline has expired, there can be direct effect in the Member States, at least as against the public sector, if the provisions of the Directive are worded in such a sufficiently clear and unambiguous way that they do not require further specification by the national legislator.
3. In this respect, affected citizens could in principle invoke the Directive against the state now that the transposition deadline had expired. In this case, the resulting obligation to act to implement the provisions of the Directive applies in particular to corporations, foundations, institutions and undertakings under public law, as well as legal persons under private law that are entrusted with the performance of public tasks and are endowed with special rights for this purpose.
4. With regard to the obligation to establish internal reporting channels provided for in Art. 8 (9) of the Directive, it must be assumed that the Directive contains sufficiently concrete and specific requirements and therefore applies directly to legal persons under public law. The mere fact that internal reporting channels can be designed in different ways is not likely to have an effect on the element of sufficient certainty.
5. This establishment obligation also covers municipalities with fewer than 10,000 inhabitants or other state agencies with fewer than 50 workers. The possibility of derogation provided for the public sector in the Directive, on the other hand, does not already have direct effect, but must be specifically regulated by the national legislator. Moreover, unlike for private sector companies, public sector companies with fewer than 250 workers are not exempt from the implementation obligation until 17 December 2023.
6. Reporting persons who turn to the internal reporting channels of the public sector, which must be established as mandatory – even without an implementing act being in place – can consequently also invoke the comprehensive protection of the Directive against retaliation measures. This applies both to the use of internal reporting channels and – subject the prerequisites set out in Art. 15 (1) b) of the Directive – also to the dissemination of information to the public.
7. In view of this, direct effect of the Directive's protective requirements for the public sector cannot be ruled out.
8. The Directive does not, on the other hand, directly require public sector employers to establish external reporting channels. In this respect, the Directive does not provide for any specific requirements regarding the external bodies to be designated, but leaves the allocation to the discretion of the Member States, which would have to exercise this discretion by way of a further legislative act.
9. Private sector employers
10. According to the established case law of the CJEU, EU Directives without transposition into national law do not have direct effect between private parties. The Directive therefore does not impose any obligations on private individuals or private sector undertakings after expiry of the transposition deadline (among others, CJEU, judgment of 14 July 1994 – Case C-91/92 – Faccini Dori).
11. Nevertheless, the CJEU has recognised what it refers to as interpretation of national law in conformity with the Directive (among others, CJEU, judgment of 4 July 2006 – Case C-212/04 – Adeneler). On the basis of this, national courts are obliged – after expiry of the transposition deadline – to interpret national law in such a way that it complies as far as possible with the wording and objectives of Union law. In this respect, the Whistleblower Protection Directive has an impact on national law through general employment law clauses and must be taken into account by national courts, for example, in the context of interpreting indeterminate legal concepts, e.g. the prohibition of victimisation (section 612a German Civil Code (BGB)) or the obligation to take account of the rights and interests of the other party in the employment relationship (section 241 (2) German Civil Code (BGB)). In this respect, reporting persons being at least indirectly protected from retaliation measures before transposition of the Directive cannot be ruled out. This can also apply to the reversal of the burden of proof provided for by the Directive, on the basis of which it is presumed that a disadvantageous measure under employment law constitutes a prohibited retaliation measure if it is taken after a report was made by the employee concerned. In this context, it is worth noting a decision by Nuremberg Higher Labour Court (LAG) which stated in its ruling of 24 February 2021 (case no.: 3 Sa 331/20) that an interpretation of the EU Whistleblower Directive in conformity with the Directive leading to a reversal of the burden of proof must definitely only take place upon expiry of the transposition deadline and not already when the provision of the Directive was enacted. Employers should keep in mind the related litigation risks in this respect.

CMS can help you to establish and operate a whistleblower system: The CMS Whistleblower System.

[1] The special features in cases where the German government or a German federal state is the employer will not be discussed here.