A whistleblower is a natural person who reports or passes on information about violations of the law or unethical behaviour received within their organisation (company or authority) in connection with their work activities.
The provisions of the HinSchG are linked to the term “employer”. This includes all natural and legal persons under public and private law as well as partnerships and associations with legal capacity.
Employers with more than 50 employees as well as all public institutions such as cities, municipalities, and districts with more than 10,000 inhabitants fall within the scope of the HinSchG. Regarding the implementation obligation of the municipalities and other legal persons under public law, see question ‘Do municipalities and other legal persons under public law already have to set up an internal reporting office?’.
In principle, municipalities and legal persons under public law are currently not covered by the scope of application of the HinSchG, even after the promulgation of the HinSchG, insofar as they are authorities of the Länder. This means that until state law regulations are enacted, there is no obligation to set up an internal reporting service. However, employees in public authorities and other public-law institutions may invoke the EU Whistleblower Directive from 18 December 2021. Possible information may come from civil servants, employees, suppliers, and service providers and may concern, for example, violations of procurement, budgetary or labour law as well as municipal bylaws.
The internal reporting office should process anonymous hints. However, there is no obligation to design reporting channels to allow anonymous hints.
The external reporting office should also process anonymous hints. However, subject to special legal regulations, there is no obligation to design the reporting channels in such a way that they enable anonymous hints to be submitted.
The internal reporting offices shall allow for oral or textual reporting. Oral reporting must be possible by telephone or other form of voice transmission. It must also be possible to meet in person if the whistleblower so wishes.
External reporting offices, on the other hand, must allow both oral reports and reports in text form. Oral reports must be possible by telephone or by another form of voice transmission. A personal interview must also be possible if the whistleblower so wishes.
The acceptance of the internal reporting offices in the company can be strengthened by the trust and independence of the reporting office. In this context, the possibility of commissioning a third party to outsource the reporting office is a good way to increase acceptance within the company.
Reprisals are acts or omissions in connection with professional activity which are a reaction to a hint or disclosure and because of which the whistleblower suffers or could suffer an unjustified disadvantage.
The reporting procedure begins with the submission of a hint. An acknowledgement of receipt must be sent to the whistleblower after 7 days at the latest. The operators of the reporting office check the validity of the hint and contact the whistleblower to obtain additional information or evidence if necessary. Feedback on the current status of the procedure and on any follow-up measures must be provided after three months at the latest.
All hints received must be documented and kept for three years after the conclusion of the procedure. For voice hints, audio recordings may only be kept with the consent of the whistleblower.
Hints that concern national security or essential security interests of the state does not fall within the scope of protection of the HinSchG. Furthermore, professional secrecy obligations must also be observed, such as judicial secrecy and medical and legal professional secrecy.
The personal scope of application of the HinSchG extends to employees who have become aware of violations in connection with their occupational activity or in the run-up to an occupational activity. These include:
Yes. In principle, the employer must set up an internal reporting office and consider the works council’s participation rights. Pursuant to section 80 (2) of the Works Council Constitution Act (BetrVG), the works council has a right to be informed about the planned establishment of a reporting office. Pursuant to section 87 (1) nos. 1, 6 BetrVG, the works council also has a right of co-determination if the establishment of the reporting office goes beyond the legal requirements.
If a whistleblower suffers a disadvantage in connection with his professional activity and claims to have suffered this disadvantage due to a whistleblowing statement, it is presumed that this disadvantage is a reprisal. The person who has disadvantaged the whistleblower must then prove that the disadvantage was based on sufficiently justified reasons or not on the whistleblowing.
This question has not yet been clarified uniformly. The European Commission is against a group-wide central reporting office. Accordingly, a reporting office that is only located at the parent company cannot apply to all subsidiaries and sub-subsidiaries. Thus, each individual subsidiary and sub-subsidiary, insofar as it falls within the scope of the Directive due to its number of employees, must also set up its own reporting office.
The German legislator explicitly allows the so-called group privilege. The explanatory memorandum to the law describes that a central reporting office is permissible as long as the commissioning company (subsidiary) remains responsible for the elimination and prosecution of an infringement. Here, too, confidentiality must be maintained. In the case of cross-border groups, it must also be considered that any language barriers in the central reporting system must not exist. Also, no additional hurdles should be imposed on whistleblowers.
It remains to be seen whether the group privilege will be maintained or whether infringement proceedings will be initiated against Germany for introducing the group privilege for this reason. For this reason, the group privilege should be viewed critically.
Yes, already implemented reporting offices can still be used as long as they meet the requirements of the HinSchG. If one follows the opinion of the European Commission, an additional internal reporting office must now be implemented at the respective subsidiaries.
In the case of groups operating across borders, the law of the respective state that protects respondents must be observed.
Trade secrets and confidential information may be reported provided that the whistleblower had reasonable grounds to believe that the disclosure of the trade secret was necessary to detect an infringement. In this context, the disclosure of trade secrets and confidential information is permissible.
Yes. The obligation to establish and operate an internal reporting office applies directly to public employers. Public employers with at least 50 employees or at least 10,000 inhabitants are obliged to do so.
Failure to implement internal reporting offices is an administrative offence punishable by a fine of 50,000 euros.
The confidentiality requirement is intended to ensure that the data of the whistleblower, the person concerned by the information and other persons connected with the information are protected.
Personal data must always be processed in accordance with data protection regulations.
With the introduction of the General Data Protection Regulation (DSGVO) and the Bundesdatenschutzgesetz (BDSG), the rights of data subjects have been noticeably strengthened. Extensive rights of access and information were introduced for data subjects. Due to the secrecy requirement under the HinSchG, these rights to information and disclosure must be limited. Pursuant to section 29, paragraph 1, sentence 1 of the BDSG, the data subject’s right to information does not apply if the information would disclose information which, by its nature, must be kept secret. Secrecy is necessary in particular because of the overriding legitimate interests of a third party (in this case, the party obliged to provide information).
In the official explanatory memorandum to the HinSchG, the legislator assumes 4 dismissals per 1,000 employees per year.
The Supply Chain Duty of Care Act (LkSG) came into force on 01 January 2023 and regulates the responsibility of companies for compliance with human rights and environmental protection rights in their own operations along the entire supply chain.
The LkSG applies from 2023 for companies with at least 3000 employees and from 2024 for companies with at least 1000 employees.
Yes! If companies are already affected by the LkSG now or in the coming year, it makes sense to combine both reporting offices. In this way, synergy effects can be used, and costs saved.