HinSchG: What must legal entities under public law now observe?

Background of the HinSchG
The Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) was announced on June 2, 2023, after a lengthy legislative process. The background of the law is the Whistleblower Directive (EU) 2019/1937 of the European Parliament and the Council. This directive came into effect on October 23, 2019, and represents the first such comprehensive set of rules for the protection of whistleblowers. The goal of the directive and the Whistleblower Protection Act is to sustainably and effectively improve whistleblower protection. It thus recognizes the important contribution whistleblowers make to the detection and punishment of misconduct. In Germany, whistleblower protection has so far been mainly shaped by case law. This is now changing with the new HinSchG.

Content of the HinSchG
The new HinSchG creates legal clarity for whistleblowers as to when and through what provisions they are protected when reporting violations. This is not only relevant for whistleblowers but also for the bodies receiving the reports.

The law envisages the following central regulatory elements for the new protection system:

The personal scope is very broadly defined. It includes all persons who have obtained information about violations in their professional environment.
The substantive scope goes beyond the requirements of the EU Whistleblower Directive and includes, for example, criminal law and certain regulatory offenses.
Choice of law: The whistleblower can choose whether to report to an internal or external reporting office. Both reporting channels exist equally side by side.
Internal reporting office: Employers are obliged to set up and operate an internal reporting office.
Disclosure: In certain cases, the whistleblower can also make violations publicly accessible.
Protection from retaliation: Whistleblowers are protected from retaliation such as termination, warnings, etc.

Who is an employer within the meaning of the HinSchG?
Employers are now required to take measures under the Whistleblower Protection Act. This includes in particular the establishment and operation of an internal reporting office, to which employees can turn. Employers under the law are:

Natural persons and legal entities under public and private law
Legal partnerships and
Other legal associations.

The circle of employers is therefore to be understood very broadly.

Which legal entities under public law are affected?
Legal entities under public law include the following, among others:

Territorial entities at the local, regional and national level
Institutions of territorial entities
Personal corporations
Association corporations at the federal and state level
In the case of job centers in the form of joint facilities under § 44b SGB II, the respective sponsors are employers
Public-law foundations
Institutions under public law
Also private law companies, if the municipality owns all shares or the majority of shares or has controlling influence over the company
Companies whose shares are held by several legal entities under public law.

The obligations from the HinSchG also generally apply to public employers when they have at least 50 employees.

Special regulations exist for the operation of internal reporting offices for the federal government and the states, as well as municipalities and municipal associations as employers:

If the federal government or a state is an employer, the highest federal or state authorities determine the organizational units in the form of individual or several authorities, administrative offices, companies, or courts, where the internal reporting office is set up and operated.
For municipalities and municipal associations and such employers that are owned or controlled by municipalities and municipal associations, the obligation with regard to internal reporting offices is governed by the respective state law. The state law can, for example, provide that municipalities and municipal associations with fewer than 10,000 inhabitants are exempted from the obligation to establish internal reporting offices.

These flexible regulations are intended to prevent fragmented structures.

When must legal entities under public law set up reporting channels?
The HinSchG comes into effect for the most part on July 2, 2023. By this time, most legal entities under public law must also have complied with the obligations from the HinSchG and have set up and operated an internal reporting office. The prevailing view even assumes that many of the obligations from the EU Whistleblower Directive have been in force since December 18, 2021 – including the obligation to implement an internal reporting office, because Germany had not transposed the directive in time at this point. The transition period until December 17, 2023, which applies to companies in the private sector, does not explicitly apply to legal entities under public law.

What is particularly important in the context of the internal reporting office?
An internal reporting office can be set up internally at the respective employer, or a third party can be entrusted with the tasks of an internal reporting office. The obliged employers hereby grant the internal reporting office the necessary powers to perform their tasks, in particular to check reports and take follow-up measures. They ensure that the persons entrusted with the tasks of an internal reporting office have the necessary expertise. The confidentiality of each report is of fundamental importance. For proper whistleblower protection, it is essential that the identities of all parties involved are largely protected. This also implies that the employees of the reporting office must be independent in their work. Any possible conflicts of interest must also be completely avoided. This poses great challenges especially for smaller administrations and authorities. It may be advisable to involve an external third party, this is also possible for public employers.

How do internal and external reporting offices differ?
The internal reporting offices within the individual authorities and administrations are to be distinguished from the external reporting offices. Both reporting channels essentially exist independently of each other. The whistleblower is thereby encouraged to make their report and not be deterred by questions of jurisdiction.

The internal reporting office is available to employees within the affected company or the affected authority, the external reporting office is set up at an independent body.

The federal government will establish an office for external reports at the Federal Office of Justice, which will serve as the central point of contact for external reports. In special areas of responsibility of BaFin and the Federal Cartel Office, further external reporting offices will also be set up. Each state also has the opportunity to set up its own external reporting offices for reports that concern the respective state administration and municipal administrations.

How expensive is an internal reporting office?
Maintaining the internal reporting office ties up resources. After each receipt of a hint, a reporting procedure must be initiated, which includes not only sending the confirmation of receipt, checking the validity, and communicating with the whistleblower but also assessing the follow-up measures and feedback. Especially the communication with the whistleblower takes up a lot of space, as often details and information need to be clarified in order to get an overview of the situation. Handling all of this in parallel to daily business represents a significant additional burden for most. All hints must also be documented and destroyed three years after the conclusion of the procedure. According to the legislative explanation, the costs for the implementation of the internal reporting offices for administrations alone amount to 71.3 million euros. Only 13.6 million of this is attributable to the federal government. The annual costs are not yet included here. The workload in the public sector is high and the responsibility is equally high. Therefore, it is particularly important for administrations to implement effective and cost-efficient reporting offices.

By outsourcing the internal reporting office to a third party, administrations can devote themselves to their core tasks, place the reporting office in trustworthy hands and at the same time save costs.

You have not yet implemented an internal reporting office? Then we should talk.

Status: June 13, 2023