Whistleblowing cases do not only affect secret services (such as the NSA scandal), professional footballers (‘Football Leaks’), or the super-rich and celebrities (Panama Papers): they also affect ‘normal’ companies. Employers who have not yet established an internal whistleblowing system are well advised to deal with the issue ASAP and prepare for the German Whistleblower Protection Act coming into effect.
Whistleblowing is still often viewed as ‘denouncing’ others. Therefore in many companies the scope for pointing out internal breaches within a protected framework are limited. The Whistleblower Protection Act, for which the draft bill of the Federal Ministry of Justice is now available, is intended to change this and to implement the EU Whistleblower Directive (read here or listen here) in Germany by 17 December 2021.
The aim of the Whistleblower Protection Act is to create a reporting system consisting of equal internal and external reporting channels in order to give whistleblowers clear possibilities for reporting violations of EU law, administrative offences or criminal law. As a result, the detection and prevention of illegal activities will be improved. At the same time, whistleblowers receive better protection so that they do not have to fear negative consequences as a result of reporting their concenrs.
The draft bill of the Whistleblower Protection Act stipulates that companies with at least 50 employees must establish internal reporting channels.
The internal reporting channels should be accessible to all employees, independent and free of conflicts of interest. Reports should be accepted both verbally and in text form. The reporting channels should be run by trained staff who should be able to make independent decisions on how to deal with cases reported. These ‘trained staff’ can be internal to the company or external third parties, such as lawyers as so-called ombudspersons.
The confidentiality of the whistleblower as well as of the individuals affected by the report must be protected. However, the reporting channels should not be obliged to follow up anonymous tips.
After receiving a report, the reporting channel must observe deadlines for reporting back to the whistleblower, documentation obligations and the possible initiation of follow-up measures such as internal investigations or submission to a competent authority.
Whistleblowers should be free to decide whether they turn to internal or external reporting channels. The draft bill therefore provides that employers must also provide information on external reporting bodies (e.g. Federal Data Protection Commissioner or Federal Financial Supervisory Authority).
Whistleblowers must be protected from negative consequences as a result of their report. If a whistleblower were to be dismissed or denied promotion after reporting a violation, it would be up to the employer to prove that this adverse treatment was not related to the whistleblowing but was based on duly justified reasons. If the employer could not prove this, it would be obliged to compensate the whistleblower for the resulting damages.
At the same time, employers should be protected from misuse of reporting channels. Therefore, in the event of deliberate or grossly negligent false information being reported, the whistleblower might be liable for damages.
The introduction of whistleblowing systems may trigger works council participation rights. If, for example, the establishment of an internal whistleblowing system includes obligations for the employees to report breaches, this is likely to affect ‘company behaviour’ and thus require works council involvement.
Depending on the specific design of the whistleblowing system, the works council’s co-determination right may also be triggered when technical facilities are introduced.
If a whistleblowing system is to be newly established or an existing system is to be adapted to the requirements of the Whistleblower Protection Act, it is worthwhile for employers to get the works council on board at an early stage in order to promote the whistleblowing system through this channel and to achieve the highest possible acceptance within the company.
Employers should check whether an existing whistleblowing system complies with the future legal requirements of the Whistleblower Protection Act with regard to reporting channels, procedural principles and confidentiality.
If there is no whistleblowing system yet, the time before the Act enters into force should be used to establish one. The most interesting options are probably the establishment of a digital whistleblowing system for written reports or the establishment of a telephone hotline, possibly with a voicemail box, where reports can be recorded.
If employers want to ensure that breaches are first resolved internally, then internal reporting channels should be as easily accessible and present as possible. A functioning whistleblowing system and broad acceptance among the workforce make an important contribution to limiting damage and avoiding direct reports to authorities.
Therefore, employers should not shy away from the obligations of the Whistleblower Protection Act. After all, a functioning whistleblowing system is an important and very effective component of a compliance policy.