The Whistleblower Protection Act is coming - what you can expect and what you need to do

On May 11, 2023, the Whistleblower Protection Act ("Hinweisgeberschutzgesetz") was passed in the German Bundestag and is now being presented to the Federal President for signature after being approved by the German Bundesrat. The Act is expected to come into force in mid-June 2023. It is therefore high time for companies to take action.

What does the Whistleblower Protection Act regulate?

The purpose of the Whistleblower Protection Act is to enable whistleblowers to report company violations of the law to internal or external bodies without suffering retaliations for doing so.
The Act contains the following key points:

• Companies with 250 or more employees must establish an internal reporting channel to which confidential reports may be submitted when the Act takes effect, which is expected to be in mid-June 2023.
• For companies with more than 50 employees, this obligation will apply as of Dec. 17, 2023.
• The internal reporting channel must enable verbal (e.g., by telephone or voice recording), written and personal reports. Anonymous reports shall also be processed, but this is not obligatory anymore under the new draft. Once a report is made, the Act specifies clear procedures and deadlines for the processing of internal reports.
• If a whistleblower suffers a disadvantage in connection with his or her professional activity following a report, the Act provides for a reversal of the burden of proof. In a potential lawsuit, the employer must be able to prove that the disadvantage is not a retaliation for the report, if the whistleblower claims that it is.
• Failure to set up an internal reporting channel despite the obligation to do so may lead to a fine of up to EUR 20,000. A fine of up to EUR 50,000 may be imposed if a report is obstructed, if there is retaliation against the whistleblower, or if confidentiality is breached. The fine provisions do not enter into force until six months after the promulgation of the Act.

What do companies need to do now?

• Companies should review whether they fall within the scope of the Whistleblower Protection Act and need to set up an internal reporting channel.
• Existing whistleblower systems should be reviewed to determine whether they meet the new Act's requirements. 
• If there is no internal reporting channel or if it is inadequate, such channel should be established or improved promptly. The co-determination rights of the works council must be observed. Follow-up questions relating to data protection should also be clarified in a timely manner.
• To strengthen the trust of the workforce in the internal reporting channel and to encourage employees to report violations internally, internal company communication is important. Companies should therefore consider developing relevant communication guidelines. 
• The internal reporting channel may be outsourced to third parties and, under certain circumstances, be operated as a joint reporting channel with other companies. It is essential to clarify at an early stage whether this is economically viable for your own company

Our compliance team combines expertise from all relevant areas of law and will of course be happy to answer any questions you may have in connection with the new Whistleblower Protection Act in your company.