Good things take time? The Whistleblower Protection Act is finally here.

After years of debate in Germany about the implementation of the EU whistleblower directive, many compliance and HR managers were in for a surprise just before Christmas: The Whistleblower Protection Act (HinSchG) could now enter into force as early as May 2023, provided that the Bundesrat grants its approval in its next plenary session on February 10. By then, all companies with 250 or more employees will need to have implemented a whistleblower system. A transition period will only be available for companies with 50 to 249 employees: Section 42 of the Whistleblower Protection Act (HinSchG) stipulates that they do not have to set up internal hotlines until December 17, 2023.

We have already reported on the need to set up whistleblower systems. The current version of the law passed by the Bundestag has addressed a number of major points of criticism:

1. The new direction: Processing anonymous reports will become mandatory

Section 16(1) of the Whistleblower Protection Act states that both internal and external reporting channels must enable and process anonymous reports. The subsequent communication with whistleblowers must also be anonymous. In contrast, the draft bill simply recommended the processing of anonymous reports. Whereas the government draft presented this as a recommended requirement, processing anonymous reports has now become mandatory. The reason for the change of direction is that given the fears of denunciation and companies being overwhelmed, it has become clear that the lack of security and trust will otherwise discourage whistleblowers. In practice, serious violations are often reported anonymously.

Corresponding technical communication channels must be set up by January 1, 2025. The lawmaker has justified the transition period with the effort and additional costs involved in the technical implementation or commissioning of an ombudsperson. Therefore, traditional reporting channels, such as the mailbox as a suggestion box or an email address, are unlikely to be adequate.

2. Greater clarity: One reporting office is enough

Group companies will be relieved to know that the recommendation for a resolution on the Whistleblower Protection Act explicitly welcomes group solutions on the basis of Section 14(1) of the Whistleblower Protection Act (HinSchG) on page 56. Therefore, affiliated companies can establish a central, group-wide reporting office. The following conditions apply: The reporting office on the group company level maintains confidentiality and is independent. Whistleblowers have easy access and are not impeded by language barriers, for example. As a consequence, it must be possible to submit reports in the working language of the respective group company. The corresponding group company remains responsible for processing the report.

This saves resources and allows the expertise to be combined at a single location. Ideally, an integrated solution is possible which also fulfills the complaint management requirements as stipulated by the German Supply Chain Due Diligence Act.

In view of the patchwork of different national implementations, some of which require separate reporting offices for each group company, international corporate groups continue to face major challenges. Furthermore, the risk remains that the EU Commission may object to the German interpretation of the EU Whistleblower Directive or that the German law will not be upheld by the European courts.

3. Attractive design of internal channels: Incentives are desired

Section 7(3) (1) of the Whistleblower Protection Act (HinschG) clarifies one important point: Employers need to create incentives to encourage whistleblowers to utilize the internal communication channel first, before turning to an external hotline. Companies are free to decide exactly how to make this option attractive. The recommendation for a resolution describes several options on page 58. These options include a good communication culture, promoting social responsibility, effective action against violations and protection against reprisals. Essentially, employers are acting in their own interest by making the internal reporting channels as attractive as possible: Ultimately, this offers employers the opportunity to identify misconduct by their employees, business partners or customers and to prevent impending damage ahead of time and before their reputation is ruined or the authorities investigate the issue.

4. Damages for bullying and stalking

Reprisals against whistleblowers can take many forms and psychological pressure such as bullying or stalking are especially difficult to prove. That is why Section 37(1)(2) of the Whistleblower Protection Act (HinschG) now enables whistleblowers to demand appropriate monetary compensation. As a consequence, whistleblowers are entitled to claim for damages regardless of whether the requirements of Section 253(2) of the German Civil Code (BGB) are met. This regulates compensation for non-material damage caused by injuries to body, health, freedom or sexual self-determination. As such, it is also not necessary to provide proof of a serious violation of general personal rights in order to receive appropriate compensation. This not only does justice to Article 21(8) and Recital 94 of the EU Whistleblower Directive, the rule also promotes the trust of whistleblowers and ultimately improves the effectiveness of the whistleblower system.

5. Extended retention period

Whereas the draft bill stated that reports should be deleted two years after the conclusion of the proceedings, Section 11(5) of the Whistleblower Protection Act (HinschG) now requires a retention period of three years in accordance with page 59 of the recommended resolution.