“New Whistleblower Protection Act: Key Points and Obligations for Companies”

With a delay of one and a half years, the Bundesrat also gave its approval to the new Whistleblower Protection Act (HinSchG) on May 12, 2023. It is expected to come into force in June 2023. Companies should therefore quickly familiarize themselves with the new regulations.

We have compiled the key points of the law for you below:

Who does the HinSchG protect?

The HinSchG aims to protect whistleblowers in the professional environment by providing for an obligation to set up internal and external reporting offices for reporting violations in the company or in an authority and by prohibiting professional reprisals for whistleblowers. Whistleblowers can not only be employees of the companies or authorities, but also employees of suppliers and shareholders.

Which companies are affected?

Companies with at least 250 employees and – regardless of the number of employees – companies in the field of securities trading as well as insurance and finance must implement the requirements of the HinSchG within one month after publication in the Federal Law Gazette. Companies with 50 to 249 employees have a little more time: they only have to comply with the new regulations by December 17, 2023.

What procedure for reporting and disclosing violations does the HinSchG provide?

The law includes three procedures: internal reporting, external reporting and disclosure.

If a person obtains information about violations in connection with their professional activity or in the run-up to a professional activity, they can choose at the first level between reporting to an internal reporting office and to an external reporting office. In doing so, it should give preference to internal reporting, provided that action can be taken effectively against the violation and no reprisals are to be feared. The external reporting office of the federal government is the Federal Office of Justice. In addition, the Federal Financial Supervisory Authority and the Federal Cartel Office act as external reporting offices at federal level for certain reports. In addition, each state can set up its own external reporting office for reports that concern the respective state administration and the respective local government. Only if the report to the external reporting office is unsuccessful or if there is a special exceptional case may the person providing the information disclose information.

What are the obligations of the affected companies?

Affected companies must set up an internal reporting office to which employees can contact with information about violations of the law. The reporting office must be staffed by independent people who can be reached in writing or orally. If desired, the report must also be submitted in person. The position does not have to be located in the company itself, instead the role can also be performed by a third party. In particular, law firms or other service providers who have the necessary specialist knowledge to fill this position responsibly come into consideration here. This is also interesting for corporations, which are given the opportunity to centralize whistleblower management at one of their group companies. Companies with 50 to 249 employees also have the option of setting up joint registration offices with other companies and thus conserving resources.

However, the HinSchG not only regulates the “whether” of an internal reporting office, but also the “how”: the HinSchG contains requirements for both the procedure and the possible follow-up measures. This includes, for example, deadlines that must be met during processing, but also documentation obligations, which in turn raise follow-up questions under data protection law. Possible measures include internal investigations or the involvement of a competent authority.

Businesses must ensure the confidentiality of the identity of the reporting person. Unauthorized persons must therefore not have access to the data of the reporting person.

In addition, companies must also process anonymous reports. Reporting channels must be provided for this purpose, which enable anonymous contact and anonymous communication between the person providing the information and the internal reporting office.
Reprisals directed against whistleblowers are expressly prohibited. Unjustified disadvantages, such as dismissals, warnings, refusal of promotion or bullying are therefore inadmissible. In the event that a person providing the information experiences professional disadvantages after a report, a reversal of the burden of proof is also provided for. If a person providing the information complains of a professional disadvantage after a report, the employer bears the burden of proof that this is not related to the report.

what threatens

Companies that do not comply with the requirements or do not comply in a timely manner face severe fines. A violation of the obligation to set up a registration office can cost up to 20,000 euros. Likewise, an intentional but also negligent breach of the duty to maintain the confidentiality of the identity of the person providing the information is subject to a fine. In addition, there are possible claims for damages.

Violating the ban on reprisals can be particularly expensive. A fine of up to 50,000 euros can be imposed for this.
Good whistleblower management is therefore essential.

On the other hand, persons who provide information are threatened with fines and claims for damages for intentionally false reports.

What should companies do now?

The HinSchG is about to come into force and the implementation deadlines are tight. Companies should now quickly determine whether they are affected by the changes and how they can best meet the requirements. Even though the new catalog of obligations of the HinSchG entails challenges, every company can benefit from a functioning whistleblower management system: Confidential information can be kept in the company, potential violations can be uncovered quickly and prevented in the future with suitable follow-up measures, which can prevent damage to reputation. A functioning whistleblower management system is therefore an essential and at the same time profitable component of an effective compliance management system.