HinSchG E: Set up and operate an internal reporting office

The search entry usually leads to the Whistleblower Protection Act (HinSchG), which has been in force since July 2, 2023 and, since December 17, 2023, has also required companies with 50 to 249 employees to set up an internal reporting office. According to Section 40 of the HinSchG, anyone who does not have a reporting office risks fines of up to 50,000 euros per violation.

This article explains the scope, obligations, deadlines and processes surrounding the HinSchG. It also shows how CIVAC, as a compliance platform and officer-as-a-service, maps the internal reporting office in an audit-proof manner, from confirmation of receipt within 7 days to feedback to the whistleblower within 3 months.

The HinSchG implements the EU Directive 2019/1937 into national law. It protects people who report violations in a professional context from disadvantages such as dismissal, transfer or bullying. Employees, applicants, self-employed people, shareholders, suppliers and former employees are protected.

The material scope of application includes violations that are subject to criminal penalties or fines, as well as violations of certain EU regulations in areas such as data protection, money laundering, public procurement, product safety, consumer protection or environmental law. Trade secrets are compared via Section 6 HinSchG and Section 5 GeschGehG.

Personally, the law applies to private employers with 50 or more employees and to the public sector. Corporations can organise the reporting office centrally in accordance with Section 14 Paragraph 1 of the HinSchG, but must ensure confidentiality at the level of the individual companies.

In the event of violations of the obligation to set up, there is a risk of fines of up to 20,000 euros in accordance with Section 40 of the HinSchG, and of up to 50,000 euros in the event of obstruction of reports or reprisals. The fines are levied by the Federal Office of Justice, the statute of limitations is 3 years according to Section 31 OWiG.

The compliance platform and the Officer-as-a-Service from CIVAC completely reflect the HinSchG. Licence the workspace for your internal representatives, or have our representatives order it. The appointment certificate, signed, filed, verifiable.

The decisive factor is the number of employees per company. The obligation applies to 50 or more employees. Employees count independently of the number of hours per week, i.e. full-time, part-time and temporary workers. According to Section 14 Paragraph 3 HinSchG, temporary workers are attributed to the hirer.

According to Section 14 Paragraph 1 HinSchG, corporations can operate a central reporting office for several group companies, provided confidentiality is maintained and whistleblowers have access to the central office. The European Commission expressly confirmed this interpretation in a letter in 2021.

Certain industries are affected regardless of the number of employees, such as financial service providers, investment firms and certain insurers in accordance with Section 12 (3) HinSchG. Additional requirements from the KWG, VAG and WpHG apply here, which contain stricter confidentiality and documentation obligations.

The public sector has its own regulations for each federal state, often with lower thresholds. Municipalities with 10,000 inhabitants or more must offer registration points, and state authorities must offer them nationwide. Here, state laws supplement the federal regulations.

In the CIVAC workspace, mark the affected companies, enter the representatives, the internal reporting office and the associated reporting lines. If you don't have a reporting point, you can see this in the dashboard directly on the home page.

The reporting office confirms receipt of a report within 7 days in accordance with Section 17 Paragraph 1 No. 1 HinSchG. The confirmation is made in writing or in text form, and the whistleblower is informed about the processing status and intellectual property rights. Delays must be justified in the logbook.

Follow-up measures will be reported back to the whistleblower within 3 months, Section 17 Paragraph 1 No. 4 HinSchG. The feedback contains measures planned or taken without jeopardizing internal investigations. In ongoing proceedings, it is sufficient to report that further investigations are ongoing.

Confidentiality applies to the identity of the whistleblower, affected persons and third parties, Section 8 HinSchG. It may only be breached if the whistleblower agrees or if there are legal obligations to provide information. Violations of confidentiality trigger fines of up to 50,000 euros.

Anonymity on request became binding with Section 16 Paragraph 1 Sentence 4 HinSchG in the final version of July 2, 2023. Reporting offices must accept and process anonymous reports. Tools with an anonymous mailbox are standard, classic email or telephone are not enough.

CIVAC provides a reporting channel in the workspace with an anonymous mailbox, confirmation of receipt and deadline tracker. Each step is versioned in the logbook. Others run compliance like a filing cabinet. We run it like software.

Whistleblowers are protected from reprisals, Section 36 HinSchG. Termination, transfer, salary reduction, bullying, denial of promotion and similar disadvantages are prohibited. The protection applies if the whistleblower had sufficient reason to believe that the report was correct at the time of the report.

The reversal of the burden of proof in accordance with Section 36 (2) HinSchG is crucial. Anyone who is disadvantaged as an employee after making a report can assert the presumption of retaliation. The employer must then prove that the measure had other objective reasons. This significantly shifts the risk of litigation.

Damages according to Section 37 of the HinSchG include material and immaterial damages, including lost earnings and career disadvantages. The claims become statute-barred three years after they become known, § 195 BGB. Procedures often lead to settlements that are significant in terms of overall costs.

False reports are not protected. Anyone who knowingly reports false information loses protection and can be called upon to compensate for the damage caused in accordance with Section 38 of the HinSchG. The threshold is high, mere misjudgments are not enough.

In the CIVAC workspace, the human resources team documents every personnel action after receiving a report with reasons, legal basis and deadline. In this way, the reversal of the burden of proof can be actively avoided. The auditor calls, the evidence is ready.

In addition to the internal reporting office, there is the external federal reporting office at the Federal Office of Justice, Section 19 HinSchG, as well as special external offices for financial service providers at BaFin and the Federal Cartel Office. Whistleblowers can choose whether they report internally, externally or both.

Companies should prefer internal reports, but are not entitled to force whistleblowers to report internally, Section 7 HinSchG. Anyone who makes the internal channel more attractive wins the report early and can react before supervisory authorities or the media get involved.

Disclosure to the public is permitted if the whistleblower has previously reported externally and no appropriate action is taken within the deadline, Section 32 HinSchG. Also in the event of an immediate or obvious threat to the public interest or in the event of reprisals.

In practical terms, this means: Anyone who takes the internal reporting office seriously, operates it professionally and builds trust significantly reduces the risk of external or public reports. Silence, delay or trivialization drives whistleblowers to external bodies and the media.

CIVAC connects internal reporting offices, case processing and reporting in a workspace with EU data residency. Licence the workspace for your internal representatives, or have our representatives order it. SLA for the initial appointment: two working days instead of the classic two to six weeks.

The reporting office processes particularly sensitive data. Identity, accusation, affected persons and status of the investigation fall under Art. 9 GDPR or at least under increased protection requirements. Processing is carried out on the basis of Art. 6 Para. 1 lit. c GDPR in conjunction with the HinSchG.

The retention period according to Section 11 Para. Special regulations from the AO, HGB or supervisory law may stipulate longer deadlines. Deletion is mandatory and must be documented in the workspace.

The technical implementation follows ISO/IEC 27001:2022 ISMS with controls A.5.7, A.8.3 and A.8.34. Data residency in the EU is actually mandatory because US cloud providers are covered by the CLOUD Act and cannot consistently guarantee confidentiality. CIVAC offers EU data residency as standard.

Permissions must be strictly managed. Only designated members of the reporting office and the processors entrusted with the process have access, Section 8 Paragraph 1 HinSchG. Separating the human resources department and the reporting office makes organisational sense in order to avoid conflicts of interest.

Roles, access and logs are configured in an audit-proof manner in the CIVAC workspace. Audit templates for GDPR Art. 30 directory, TOM according to Art. 32 GDPR and deletion concept are available. Audit-proof, documented, § 8 HinSchG-proof.

Fines according to Section 40 of the HinSchG range up to 50,000 euros per violation. Retaliation, obstruction of reporting and breaches of confidentiality are the most costly offenses. The obstruction of processing by superiors is also proven and is increasingly being pursued.

In addition, Section 130 OWiG applies if management violates supervisory obligations. Fines of up to 10 million euros are possible, combined with civil law claims for damages from whistleblowers. Damage to reputation if a case is lost in court or in the press regularly exceeds fines.

Typical supervisory review questions are: When was the reporting office set up, who runs it, are the reporting channels announced, is there an anonymous mailbox, are deadlines adhered to, how is confidentiality maintained, how is data storage organised, is there a reporting line to management?

The reporting line is organisational and anchored in the order. The reporting office must be able to work free of conflicts of interest, Section 15 HinSchG. In the event of allegations against the management, it reports to the supervisory board or advisory board, documented in the rules of procedure.

CIVAC provides 490 ready-to-use audit templates, including the reporting office's rules of procedure, reporting line, appointment certificate and training matrix. Deadline begins as soon as we become aware of it. The system indicates open deadlines 14, 7 and 1 day before expiry.

The reporting office touches on several roles. The data protection officer advises on GDPR, retention periods and the rights of those affected to information. In the event of data breaches in the reporting channel, Art. 33 GDPR applies with the 72-hour reporting requirement to the supervisory authority.

The money laundering officer according to the AMLA has his own reporting obligations to the FIU. Information about money laundering from the HinSchG reporting office can be transferred to the AMLA system, provided confidentiality is maintained. The compliance officer coordinates the interfaces.

If corruption, fraud or breach of trust is suspected, the question of when criminal charges should be filed must be clarified. There is no blanket obligation to report, but there is an obligation to provide internal information. Section 130 OWiG requires supervisory measures that cannot be delayed indefinitely.

The Supply Chain Due Diligence Act LkSG applies to allegations against suppliers. Information from the reporting office must be integrated into risk management in accordance with Section 4 LkSG. The LkSG representative and the reporting office work hand in hand.

CIVAC integrates these interfaces into one platform. Master and case data are maintained once, roles see the same status. Others run compliance like a filing cabinet. We run it like software. EU data residency and ISO 27001:2022 ISMS are standard.

A HinSchG reporting point only has an impact when whistleblowers have trust, deadlines are met and management sees results. Excel lists, shared mailboxes and improvised telephone lines do not meet the requirements and expose the company.

CIVAC is built as a compliance platform and officer-as-a-service to get reporting points up and running quickly and in a verifiable manner. 25 representative roles run in the same workspace, 490 audit templates cover HinSchG, GDPR and compliance, EU data residency and ISO 27001:2022 ISMS are standard.

Licence the workspace for your internal representatives, or have our representatives appointed. SLA for the initial appointment: two working days instead of the classic two to six weeks. This means that the reporting office can be reported within one working week, including the appointment certificate.

During onboarding, we scan existing reporting channels, rules of procedure and training courses. You can immediately see which deadlines are open, which training courses are missing and whether the directory according to Art. 30 GDPR already contains the reporting office. Reporting line and escalation path are anchored in the first meeting.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de, and you will have an initial consultation and a concrete timetable for your registration office within two working days.