German Whistleblower Protection Act Brings New Obligations for Companies
Client Alert | May 17, 2023
On May 12, 2023, the German lawmaker passed a law protecting those who report violations around the workplace (the “Whistleblower Protection Act”, or “Act”). As an essential part of the Act, companies with 50 employees or more in Germany must establish internal reporting channels for this purpose.
I. Background
The new law implements the EU Whistleblower Directive 2019/1937 (“Directive”), which was due to be transformed into national law by December 17, 2021. Like most other EU member states, Germany was late in implementing the law.[1]
With regard to the scope, the German lawmaker goes far beyond the Directive in that almost all kinds of violations can be subject to protected whistleblowing. This even includes actions that are not illegal, but deemed to be an “abuse”, because they are directed against the “purpose” of legal provisions.
II. Main Obligations
Under the Act, there are three kinds of whistleblowing: (i) internal reporting within an organization, (ii) external reporting to a special government agency, and (iii) public disclosure. The latter is only permissible if external reporting has not proven successful or in several other cases, i.e., if there is an urgent threat to public interests. Unfortunately, as mandated by the Directive, the Act does not stipulate a priority of internal over external reporting. However, employees are explicitly enhanced to do so, and employers are supposed to promote internal over external reporting.
Companies with 50 or more employees in Germany have to offer internal reporting lines for whistleblowers and set up properly (yet not necessarily full-time) staffed functions to deal with such reports. The company can outsource such tasks to an external partner or – as will often be the case – defer to its centralized group reporting scheme as long as the local entity remains responsible for remediation measures.[2] There is a transition rule for companies between 50 and 249 employees: Their obligation to set up internal reporting lines is deferred until December 17, 2023.
Neither internal nor external reporting lines have to provide for anonymous reports, but should handle them nevertheless.
III. Identity Protection, Non-Retaliation
The internal reporting cell has to protect (i.e. not disclose) the identity of good-faith whistleblowers, not even to the company’s management, unless the whistleblower consents or a public authority asks for it. The person being subject to the report enjoys a similar, yet weaker disclosure protection.
Whistleblowers acting in good faith must not be retaliated against in any way because of their report. Such retaliation could consist in, e.g., dismissal, pay cut, relocation, or other disadvantages by the employer.
If there has been a retaliation against the whistleblower, they can claim damages from the parties responsible for the retaliation (typically the employer).
In order to help the whistleblower procedurally, the Act presumes that any disadvantage after the report is presumed to be retaliation. This presumption can be rebutted, and employers should carefully document their personnel measures against whistleblowers in order to be able to prove that the measure is based on other reasons than the whistleblowing.[3]
Finally, good-faith whistleblowers shall not be legally liable for retrieving the information they report, unless the access or use of said information was a criminal act in itself. Even trade secrets may be disclosed, if it is necessary to lance the report.
IV. Companies’ Responses and Next Steps
Any company with 50 employees or more in Germany now has to check whether they have adequate reporting lines in place and properly staffed functions to handle whistleblower reports. Companies with 50 to 249 employees do not have to install the reporting lines until December 17, 2023.
Other than the Directive, the German lawmaker expressly acknowledges centralized reporting lines to be in line with the Act. This is good news for multinational organizations, after the EU Commission fervently contested that such centralized systems were in line with the Directive. It remains to be seen whether the EU Commission accepts those local laws that allow centralized reporting lines.
Multinational organizations operating companies with more than 50 entities in multiple EU member states are well advised to assess the requirements of the respective local implementation laws. In light of the leeway granted to the EU member states in implementing the Directive, individual provisions may vary significantly across the EU member states.
HR departments should carefully prepare and document any measure against employees that might be perceived as retaliation in case the employees have launched a whistleblower report. If the employers can provide sound reasons for their decision, they should be able to rebut the statutory presumption contained in the Act.
Violations of the obligations contained in the Act carry a fine of up to € 50,000.
__________________________
[1] See https://www.whistleblowingmonitor.eu/ for an overview of the implementation status across the EU members states.
[2] See https://www.gibsondunn.com/wp-content/uploads/2022/02/Zimmer-Humphrey-Petzen-Ja-bitte-Meldesysteme-nach-der-Whistleblower-Richtlinie-der-EU-Betriebs-Berater-02-2022.pdf.
[3] See https://www.gibsondunn.com/hilfe-fur-hinweisgeber-beweislastumkehr-nach-%c2%a7-36-ii-hinschg-rege/.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact the Gibson Dunn lawyer with whom you usually work, any member of Gibson Dunn’s Labor and Employment or White Collar Defense and Investigations teams in Germany, or the following authors in Munich:
Katharina Humphrey (+49 89 189 33 217, [email protected])
Mark Zimmer (+49 89 189 33 230, [email protected])
Corporate Compliance / White Collar Matters
Ferdinand Fromholzer (+49 89 189 33 270, [email protected])
Kai Gesing (+49 89 189 33 285, [email protected])
Markus Nauheim (+49 89 189 33 222, [email protected])
Markus Rieder (+49 89 189 33 260, [email protected])
Benno Schwarz (+49 89 189 33 210, [email protected])
Finn Zeidler (+49 69 247 411 530, [email protected])
© 2023 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice. Please note, prior results do not guarantee a similar outcome.