HinSchG and the Federal Council: The long road to the whistleblower protection law and its operational obligations

The Whistleblower Protection Act (HinSchG) came into force on July 2, 2023 and implements the EU Whistleblower Directive (Directive (EU) 2019/1937) into German law. The route there was unusual. The Bundestag passed the law on December 16, 2022. The Bundesrat refused approval on February 10, 2023. The Mediation Committee reached an agreement on May 9, 2023, the Bundestag voted on May 11, 2023, and the Bundesrat followed on May 12, 2023. In the meantime, the EU Commission had filed a lawsuit before the ECJ on February 15, 2023 due to delayed implementation.

In terms of content, the negotiations brought changes that are relevant for operational implementation: the obligation to accept anonymous reports was introduced defused, the fine limit was halved from 100,000 euros to 50,000 euros, and the reference to anti-constitutional statements was deleted. This article summarizes the genesis and current obligations today, with a focus on companies with 50 to 249 employees for which the obligation has applied since December 17, 2023.

The EU Whistleblower Directive (Directive (EU) 2019/1937) would have had to be implemented by December 17, 2021. Germany clearly missed the deadline. The government draft was approved by the Federal Cabinet on July 27, 2022, and the Bundestag passed the law on December 16, 2022. The Bundesrat refused approval on February 10, 2023, even though the Federal Government had originally classified the law as not requiring approval. The background was the dispute over the obligation on the states to set up external reporting offices.

The federal government called the mediation committee on March 30, 2023. The agreement on May 9, 2023 reduced the range of fines, clarified the obligation to process anonymous reports and eliminated some factually and politically controversial passages. The Bundestag confirmed the mediation result on May 11, 2023, and the Bundesrat agreed on May 12, 2023. The announcement in the Federal Law Gazette took place on June 2, 2023, and the law came into force on July 2, 2023. The Commission's ECJ action against Germany was withdrawn after it came into force. Anyone who knows the genesis understands why commentary literature and official notices sometimes referenced contradictory versions.

§ 12 HinSchG obliges employers with at least 50 employees to set up an internal reporting office. According to Section 42 of the HinSchG, a transition period until December 17, 2023 applied to employers with 50 to 249 employees. Since this date, the obligations have applied across the board. The obligation has been in effect for employers with 250 or more employees since it came into force on July 2, 2023. The obligation without a threshold includes, among others, investment services companies, capital management companies, insurance companies, certain financial service providers and those obliged under the Money Laundering Act.

The threshold is measured by the number of employees without taking into account trainees and temporary workers who are employed on the basis of an order from the employer. Joint reporting offices of several companies are permitted according to Section 14 Paragraph 2 HinSchG, provided confidentiality is maintained. According to Section 14 Paragraph 1 HinSchG, corporations can assign the tasks of an internal reporting office to another group company, which the Federal Ministry of Labour has expressly made clear. The overview of the internal reporting office describes the obligations in practice.

§ 2 HinSchG defines the material scope of application. Reports of violations that are punishable by law, of violations that are punishable by a fine, to the extent that the violated regulation serves to protect life, limb or health or the protection of the rights of employees or their representative bodies, as well as violations of federal and state legal regulations and directly applicable legal acts of the EU in the areas listed in Section 2 Paragraph 1 Number 3 are protected.

The list includes money laundering and terrorist financing, product security, Road safety, environmental protection, radiation protection, food and feed safety, animal health, public health, consumer protection, data protection and security of network and information systems, financial interests of the EU, internal market including competition and state aid law and corporate taxation. Tax reports about sales tax and corporation tax are expressly covered, but income tax violations are not. After the mediation agreement, violations of anti-constitutional statements are no longer expressly covered, but some of them fall under other offenses (for example Section 130 of the Criminal Code). The distinction from unrecorded reports is part of the work of the representative of the internal reporting office, who coordinates with the Compliance representative.

§§ 12 to 18 HinSchG regulate the internal reporting office. It must enable oral, written and, if requested, personal reports. Oral reports are made by telephone or other forms of voice transmission; Personal meetings must be made possible within a reasonable time. The internal reporting channels must be designed in such a way that the confidentiality of the identity of the person providing the information and the other persons named in the report is maintained. Only the people responsible for receiving them and people who support them in fulfilling their tasks have access to the reports.

§ 17 HinSchG defines the procedure. Confirmation of receipt to the whistleblower within seven days, checking the validity, maintaining contact, taking appropriate follow-up action and feedback to the whistleblower within three months of confirmation of receipt. Follow-up actions include internal investigations, referral to the appropriate body, referral to a competent authority or closure of the procedure. Deadline begins as soon as we become aware of it. Anonymous reports should be processed; there is no mandatory obligation to process them based on the outcome of the mediation; The practice tends to accept anonymous reports in order not to undermine the protection under Section 35 HinSchG by de facto blocking them.

§ 36 HinSchG prohibits any discrimination against whistleblowers and those associated with them because of a report or disclosure. Disadvantages include dismissal, denial of a promotion, transfer, reduced pay, exclusion, bullying, unjustified negative performance reviews, cancellation of a promotion and similar disadvantages. Section 36 paragraph 2 of the HinSchG contains a reversal of the burden of proof: If a reporting person suffers disadvantage after making a report, it is presumed that the disadvantage was a consequence of the report. The employer must prove that the measure was based on sufficiently justified reasons or that it was not based on the report.

§ 37 HinSchG regulates compensation for damages. If the prohibition of discrimination is violated, the responsible person owes compensation for the damage caused. Even damage that is not financial loss must be compensated appropriately in money. The protection extends to employees, applicants, former employees, self-employed people, shareholders, managing directors, members of executive bodies and advisory bodies as well as interns and people who carry out activities under the supervision and direction of the employer. The appointment certificate, signed, filed, verifiable. The reversal of the burden of proof makes the documentation of every personnel-relevant decision after a report a central task.

§§ 19 to 31 HinSchG regulate the external reporting offices. The federal external reporting office has been set up at the Federal Office of Justice in accordance with Section 19 HinSchG. There are special external reporting offices at the Federal Financial Supervisory Authority (BaFin) for violations within the scope of securities trading and banking supervision law and at the Federal Cartel Office for violations of antitrust law. According to Section 20 HinSchG, the federal states can set up their own external reporting offices, there is no obligation.

In accordance with Section 7 Paragraph 1 HinSchG, reporting persons can freely choose whether they use an internal or an external reporting office. This freedom of choice was controversial in the original Bundestag draft; the HinSchG has adopted it unchanged. Section 7 Paragraph 2 of the HinSchG recommends internal reporting as long as effective internal action can be taken against the violation and the person reporting the information does not fear reprisals. In practice, a professionally set up internal reporting point strengthens trust and reduces the rate of external reports. An external report does not lead to sanctions for the person who provided the information, even if the internal body was not contacted first. Others run compliance like a filing cabinet. We run it like software.

§ 40 HinSchG provides for fines. Impeding a report or communication between the person providing the information and the internal or external reporting office is punished with up to 50,000 euros. Retaliation against a whistleblower, violation of the confidentiality requirement and intentional or negligent disclosure of the identity of the whistleblower are also punished with up to 50,000 euros. Failure to set up an internal reporting point is punishable by a fine of up to 20,000 euros in accordance with Section 40 Paragraph 2 Number 2 HinSchG. The fine limit was reduced in the mediation committee from the original 100,000 euros to 50,000 euros.

The processing of personal data in the internal reporting office is permitted in accordance with Section 10 of the HinSchG and Article 6 of the GDPR. Section 11 HinSchG requires documentation of every report. Oral reports must be documented in a complete and accurate transcript, in a permanent and retrievable audio recording with consent, or in a transcript of the conversation. The documentation must be retained for three years after completion of the procedure and deleted immediately if it is no longer required to fulfil the tasks. Longer storage is permitted if this is necessary for legal purposes and proportionate. The auditor calls, the evidence is ready.

Setting up a legally secure internal reporting point can be done in 30 days if the order is correct. Step 1: Certificate of appointment of the reporting office representative with powers, reporting line and independence clause. Step 2: Rules of procedure with confirmation of receipt (seven days), feedback period (three months), escalation paths and GDPR deletion and retention rules. Step 3: Technical reporting channels (web form, email inbox, telephone line with voicemail function, personal meeting on request).

Step 4: Training of representatives and management on confidentiality, bias and investigation standards. Step 5: Communication to the workforce via notice boards, intranet, onboarding and contracts with external employees. Step 6: List of processing activities in accordance with Article 30 GDPR, adaptation of the data protection information and, if necessary, data protection impact assessment in accordance with Article 35 GDPR. Step 7: Test the input channel with a documented sample message. Step 8: Reporting structure to management with quarterly and annual reports. Licence the workspace for your internal representatives, or have our representatives order it. Audit-proof, documented, § 12-firm.

CIVAC is a compliance platform and officer-as-a-service. For the HinSchG, the platform offers a secure reporting channel with EU data residency, a procedural code as a template, confidentiality protection through role-based access, integrated seven-day and three-month deadlines, as well as documentation templates that comply with Section 11 of the HinSchG. The 490 ready-to-use audit templates are supplemented by specific modules for confirmation of receipt, follow-up measures and final report.

The dual model is simple: Licence the workspace for your internal representatives, or have our representatives order it. If you don't have a free head in the legal department or want to maximise anonymity with your employer, choose external appointment. The CIVAC SLA for an order is two working days, instead of two to six weeks in the classic market. The appointment certificate, signed, filed, verifiable. Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de. The deadline expires as soon as we become aware of it, and the next receipt requires confirmation of receipt within seven days.