Federal Cabinet approves Whistleblower Act

Background

The Whistleblower Act implements the EU Whistleblower Directive, which seeks to establish standard protections for informants throughout the EU. Implementation is long overdue, as the deadline for transformation into national law ended on 17 December 2021. In 2019, Germany provided some protection for whistleblowers with the adoption of the “Act on the Protection of Business Secrets”. However, this new draft bill goes far beyond the 2019 Act.

Content of the draft bill

The Whistleblower Directive and the German Whistleblower Act are designed to establish comprehensive protection for whistleblowers. This is based on the following components:

• Companies and organisations with more than 50 employees must establish and operate a secure internal whistleblower system. Small companies with fewer than 250 workers have been granted a “grace period” until December 2023.
• Whistleblowers must have the option of providing information orally, in writing or in person, as they wish.
• When information is provided, the internal reporting channel must provide the whistleblower with confirmation of receipt within seven days.
• Within three months, the competent person or body must inform the whistleblower of the measures taken, e.g., the opening of an internal compliance investigation or the referral of the matter to the relevant authority, such as a law enforcement agency.
• Second, Germany must establish the equivalent possibility to provide information to the Federal Office of Justice (Bundesamt für Justiz) as an external notification body. The Laender can also establish bodies that whistleblowers may notify in such situations.
• Whistleblowers can decide freely whether to notify the internal company body or the external body.
• To protect the whistleblower against “retaliation”, the law contains a wide-reaching reversal or the burden of proof: if a whistleblower is “disadvantaged” with respect to their professional activities, it will be assumed that the disadvantage they face is in retaliation. In addition, the whistleblower may claim damages for the (assumed) retaliation.

Significance for practice

Companies and organisations should prepare for and organise professional installation and implementation of an internal notification system in good time because failure to do so can result in significant fines. If a whistleblower system is already part of the internal compliance management system, companies should assess whether the system is in line with the requirements of the Whistleblower Protection Act and make any necessary adjustments in time.

Particular care should be taken with respect to the reversal of the burden of proof when implementing personnel measures “near” the whistleblower, such as in their team or at their level. This is particularly important when the whistleblower reveals their identity (they are not required to remain anonymous), when there is an exemption releasing the notification body from the duty to maintain confidentiality (§ 9 of the draft bill), or when the notification body infringes the duty of confidentiality. In such cases, the identity of the whistleblower will be exceptionally known. Accordingly, a failure to consider the whistleblower for a pending promotion, but even the breach or simple failure to extend a fixed-term employment contract could be considered “retribution”. As a result, the employer will have to show that they have not disadvantaged the whistleblower due to the notification made by the employee. If this exculpatory evidence is insufficient, the employer may face a claim for damages from the whistleblower, as well as fines. Employers should therefore be prepared for the reversal in the burden of proof to be used as an additional “weapon” in an action against unfair dismissal, which could make it more difficult to defend against such a claim.

Conclusion

The Whistleblower Act will require all companies with more than 50 employees to review and adapt any existing internal whistleblower system or to establish such a system for the first time. Companies should consider whether to outsource and use a third party as their notification body and as the operator of the notification system. In any case, companies are required to follow up on notifications, take measures and remedy violations. Finally, employers must ensure that any whistleblower is protected against retribution. At the same time, they should bear in mind the potential for misuse of the new reversal of the burden of proof.

Dr Anne Dziuba, Maike Pflästerer, and Dr Michael Matthiessen