On 23 October 2019, the European Parliament and the Council of the EU, the two lawmaking bodies of the European Union, passed the EU Whistleblower Directive that aims to protect whistleblowers of companies active in the European Union. Although the EU Whistleblower Directive stipulated that it had to be implemented and integrated into national law of the EU Member States by 17 December 2021, only 11 of the 27 EU Member States have implemented it in compliance with the stipulated deadline. After France passed the corresponding implementation law at the beginning of 2022, many international corporations looked to Germany with a wait-and-see attitude to subsequently take concrete measures to comply with the new EU’s whistleblower protection. Against this background, on 27 July 2022, the German government adopted the draft of the implementation law that was subsequently discussed in the German Parliament (Bundestag) since September 2023. Finally, on 16 December 2022, the Bundestag passed the German Whistleblower Protection Act (“Hinweisschutzgebergesetz”, hereinafter: “HinSchG”). The next step is for the Bundesrat to approve the HinSchG, which is not expected until the first plenary session in February 2023 at the earliest.

The law provides for several – in part far-reaching – changes to the current legal situation in Germany. The obligation to introduce a whistleblowing system shall apply to companies with at least 50 employees (§ 12(2) HinSchG). Irrespective of the number of employees, companies in certain sectors, such as financial service providers, are already obliged to set up whistleblowing channels under existing law. The personal scope of the HinSchG shall include all persons that have obtained information about violations in connection with their professional activities (§ 1(1) HinSchG). This covers primarily employees of the company in question. In addition, companies might be able to decide whether their reporting channels shall also be open to third parties, such as contractors or suppliers (§ 16(1) HinSchG).

Reports of “serious infractions” are what the HinSchG is meant to cover. This includes offenses that are punishable by law (criminal offenses) as well as offenses that are subject to a fine (administrative offences). The latter, however, only insofar as the violated law aims to safeguard the rights of workers or their representatives, like members of the works council (§ 2(1) HinSchG). The HinSchG identifies additional offenses that come inside the material scope in addition to these general laws, such as transgressions of laws pertaining to data security, product safety and conformance, environmental protection, and anti-money laundering. Whistleblowers must be given the option to report information to an external reporting channel or an internal reporting channel within the organization (§ 7 HinSchG). The Federal Office of Justice will serve as the external reporting route, but BaFin and the Federal Cartel Office will also serve in this capacity. Internal reporting processes are not prioritized by the German legislature.

The fundamental form of protection for whistleblowers under the HinSchG is the ban on retaliation (§ 36(1) HinSchG). Retaliation has a broad definition and can include anything from dismissal to disciplinary action, as well as mobbing, discrimination, or exclusion. The law prohibits to threaten or to really carry out retaliation. Whistleblowers may not enter into termination agreements if they are coerced into doing so, such as by threats of retaliation. The burden of proof is reversed in favor of whistleblowers under the HinSchG. If a whistleblower experiences a disadvantage in their professional activity because of filing the complaint, it is assumed that retaliation has occurred. Companies are required to compensate whistleblowers for damages if they violate this prohibition against retaliation. Furthermore, whistleblowers are entitled to appropriate monetary compensation for damages that are not pecuniary damages, regardless of the requirements of § 253 (2) BGB (i.e., the German Civil Code) or the existence of a serious violation of the general right to privacy (§ 37(1) HinSchG) to be met. In addition, retaliation may result in a fine of up to EUR 100,000 (§ 40(2)(3) & (6) HinSchG).