The Whistleblower Protection Act (HinSchG) aims to better protect whistleblowers who draw attention to wrongdoing in the course of their professional activities. It prohibits any reprisals against whistleblowers and obliges companies to set up secure channels for reporting wrongdoing. After the act came into force on 2 July 2023, companies with more than 250 employees initially had to implement the requirements. In certain sectors (e.g. financial services or insurance companies, see the list in Section 12(3) HinSchG), the requirements apply regardless of the number of employees. For companies with 50 or more employees a longer implementation period applied, but this has now also expired on 17 December 2023.
What do companies need to consider?
A secure internal whistleblowing system must be set up. This means that whistleblowers must be able to submit reports orally, in writing or, on request, in person. Reporting channels can be, for example, an online platform or a dedicated e-mail address. It is also possible to set up a whistleblower hotline or an answering machine system. Clear rules must be issued within the company on how reports are to be handled. If the company has a works council, it must be involved in setting up the reporting system, as it has co-determination rights in this respect.
It is also possible to use an external reporting office (e.g. at the Federal Office of Justice or ombudspersons). Whistleblowers are completely free to decide whether to submit a report to their company’s internal reporting office or to use the external reporting office. Anonymous reports should also be followed up. The confidentiality requirement laid down in Section 8 HinSchG is absolutely central. “Reporting officers” within the company can be, for example, the head of compliance, a legal counsel, the data protection officer or the person responsible for audits. However, it must be ensured that their other tasks do not lead to conflicts of interest and that they can act independently. Managing directors or HR managers generally cannot be reporting officers because of existing conflicts of interest.
To protect whistleblowers from “reprisals”, the act contains a far-reaching reversal of the burden of proof: if a whistleblower suffers a disadvantage in connection with their professional activities, it is presumed that this disadvantage is a reprisal. Reprisals are not only prohibited, but can also be punished with high fines of up to 500,000 euros for the company.
Important to know: companies that fail to comply with their obligation to introduce and operate an internal reporting office face a fine of up to 20,000 euros. So action is needed!
