The German Whistleblower Protection Act (HinSchG) is intended to protect whistleblowers from reprisals in a professional context. We explain the regulations for employers and show in particular how you can achieve compliance through an internal reporting channel.
In a nutshell
- The Whistleblower Protection Act protects whistleblowers from (professional) reprisals.
- Companies and public institutions with 50 or more employees and municipalities with 10,0000 or more inhabitants must set up an internal reporting channel.
- The acceptance of anonymous reports is not mandatory.
- Certain deadlines apply to the processing of reports and feedback to whistleblowers.
What is the current status of the Whistleblower Protection Act?
The Whistleblower Protection Act came into force on July 2, 2023 (see the documentation of the German parliament (Bundestag)). All deadlines for implementation in companies have already expired. The Whistleblower Protection Act is therefore fully applicable.
Who is protected by the Whistleblower Protection Act?
The Whistleblower Protection Act transposes the provisions of the EU Whistleblower Directive into German law with the aim of protecting people who have gained knowledge of violations of statutory provisions or other binding regulations in the course of their professional activities and report these from reprisals. Whistleblowers should thus be able to disclose grievances without fear of reprisals (§ 1 HinSchG).
Employees within the meaning of § 3 HinSchG are:
- Employees,
- Employees employed for the purpose of vocational training,
- Civil servants,
- Judges (but not honorary judges),
- Soldiers and servicewomen,
- employee-like persons and
- People with disabilities who work in a corresponding facility.
Ultimately, it should also be in the interest of the respective organisation to learn of violations as early as possible so that they can be remedied quickly. Compliance as a general objective is also supported by the law. Unfortunately, however, it is by no means a matter of course that people who disclose wrongdoing actually remain unharmed. For this reason, the Whistleblower Protection Act prohibits issuing warnings to whistleblowers or otherwise discriminating against them in any way on the basis of their information.
Of course, the protection of the whistleblower only applies if the report was not abusive, grossly negligent, or even intentionally false. In such cases, it is still possible to take action against the reporting person and, for example, assert claims for damages.
For the consistent protection of whistleblowers, a reversal of the burden of proof applies in the event of reprisals in connection with a report that has been made. If, for example, the report of a violation is followed by a dismissal, a connection is assumed, and the employer must disprove this. The whistleblower must be compensated for any damage caused by the reprisals.
Of course, the Whistleblower Protection Act also contains the appropriate levers to ensure enforcement. Violations of central requirements (such as not setting up an internal reporting channel) can be punished with fines of up to EUR 50,000 (§ 40 HinSchG).
What information is covered by the law?
First of all, all reports of criminal offenses fall under the protection (§ 2 HinSchG), which in itself makes the scope of application quite broad.
However, infringements that are only subject to a fine are also covered if the violated regulation serves to protect life, limb, or health, or the protection of employees or their representative bodies. This means that violations of road traffic regulations, for example, are already within the scope of application, as is non-compliance with regulations on the minimum wage or working hours.
In addition, a number of selected regulations fall within the scope of application, for example from antitrust law, environmental law, radiation protection, food and product safety. Regulations on the prevention of money laundering and combating the financing of terrorism are also covered, as are consumer and data protection.
In individual cases, it can be difficult to decide whether a violation falls under whistleblower protection. It is not necessarily obvious that violations of the German General Equal Treatment Act (AGG) are not included.
With this in mind, companies are well advised to choose their reporting channel carefully to ensure that, in addition to correct treatment, well-intentioned false reports are also handled with appropriate sensitivity.
What does the law say about reporting channels?
External and internal reporting channels
First of all, a distinction must be made between internal and external reporting channels.
According to the HinSchG, whistleblowers are generally free to choose whether to contact an internal or external reporting channel (§ 7 HinSchG). The law merely suggests that preference should be given to the internal reporting channel, provided that effective action can be taken against the violation and no reprisals are to be feared.
External reporting channels should only be notified if no internal remedial action has been taken. External reporting channels are those set up by the federal or state governments and some supervisory authorities.
Obligation to set up internal reporting channels
Different regulations apply to companies and public institutions when setting up an internal reporting channel, usually depending on the number of employees (§ 12 HinSchG):
- Less than 50 employees: An internal reporting channel is not necessary. However, this does not mean that the regulations on whistleblower protection are not applicable overall! The law applies to all companies and organisations.
- 50 or more employees (or in the case of municipalities: 10,000 or more inhabitants): An internal reporting channel must already be set up.
- For some industries, such as the financial and insurance sector, the obligation to set up internal reporting channels applies regardless of the number of employees.
Organisation of internal reporting channels
The term internal reporting channel is slightly misleading. All reporting channels that an organisation appoints itself are considered internal. This means both reporting channels that are set up within the organisation and those for which a service provider is used (§ 14 HinSchG). It is therefore not necessary to train and deploy your own staff. It is also possible to assign the task to bodies outside the organisation, such as lawyers. This is referred to as a whistleblowing ombudsperson.
The only mandatory requirement is that the reporting channel can act neutrally, independently, and reliably (expertise!) (§ 15 HinSchG). In the example of lawyers mentioned above, the lawyers should therefore not represent the company at the same time, as this would involve a conflict of interest.
Note for companies with employee representatives: The establishment of the registration channel is subject to co-determination.
Note for corporate groups: Corporate groups can share an internal reporting channel regardless of their size (§ 14 (1) HinSchG).
Note for smaller companies: Several private employers, each with no more than 249 employees, can share an internal registration channel (§ 14 (2) HinSchG).
Mandatory reporting channels
Reporting channels must accept reports verbally (e.g. by telephone), in writing (e.g. by means of a whistleblower system or e-mail) and in person, if the person making the report so wishes.
The reporting channel must document all reports carefully and permanently. Special regulations apply to verbal reports if a recording or verbatim record is to be made.
Anonymous messages
Organisations are free to decide whether to offer the option of anonymous reporting. The legislator has not been able to bring itself to prescribe such an option. Instead, § 16 of the HinSchG contains vague wording:
“The internal reporting channel should also process anonymous reports.”
Irrespective of this, the identity of the whistleblower and the persons affected by the report are subject to special protection (§ 8 HinSchG). In principle, the identity may only be disclosed to employees who are specifically responsible for handling the report (§ 16 HinSchG). Exceptions apply, for example, if the report is the subject of a criminal investigation (§ 9 HinSchG).
Tip: Read our guide on data protection in whistleblowing.
Deadlines for internal notifications
Internal reporting channels must comply with the following deadlines (§ 17 HinSchG):
- Confirmation of receipt of the report to the whistleblower within seven days;
- Feedback to the whistleblower on planned or already taken follow-up measures and the reasons for them within three months.
Dealing with messages
In addition to the deadlines already mentioned and the requirement of confidentiality, the Whistleblower Protection Act sets out a number of key requirements for dealing with reports in internal reporting channels (§ 17 and § 18 HinSchG):
- The first step is to check whether the report falls within the material scope of the law and whether the misconduct complained of is mentioned in § 2 HinSchG.
- The validity of the report must then be checked. For this purpose, further communication can be established with the reporting person (if possible, especially in the case of anonymous reports).
- If the first two points apply, the internal reporting channel can, in particular, initiate internal investigations or refer the procedure to other bodies (including competent authorities) as follow-up measures.
What companies should do now
As the Whistleblower Protection Act has already come into force and all deadlines have expired, companies must act quickly if the following points have not yet been (sufficiently) implemented. Fines can be imposed at any time.
- For 50 or more employees: Establishment of an internal reporting channel, preferably as a whistleblower system and, if necessary, combined with an (external) whistleblowing ombudsperson.
- Creating and publicising a whistleblowing policy (or similar) for dealing with reports that have been made.
- Review and, if necessary, adapt existing whistleblowing regulations for compliance with the Whistleblower Protection Act and communicate all changes to the workforce.
- If necessary, adjustment of regulations on labour law sanctions and promotions in order to do justice to the reversal of the burden of proof in the case of whistleblowers.
