Whistleblowing system: How whistleblowing becomes an opportunity for your company

What lasts a long time - finally becomes law

The HinSchG was promulgated on 2 June 2023 and came into force on 2 July. Since then, it must be observed and implemented by companies. After a very bumpy and delayed legislative process, the implementation of the EU Whistleblower Directive in the German Whistleblower Protection Act must now also be observed in Germany.

For the first time, the legislator in the Union and in Germany is thus improving the legally precarious position of whistleblowers. They can now provide information in a secure environment. In Germany, the HinSchG recommends that anonymous whistleblowers also be processed. Even if the German special approach with the obligation to process anonymous reports could not be enforced in the end, it can only be recommended to every company manager to take anonymous reports seriously and to pay attention to them. Corporate bodies can quickly find themselves in a situation of personal liability if they do not pay attention to known risks and legal grievances in the company and do everything necessary to remedy them.

If you have any questions about corporate liability, please do not hesitate to contact us. We will put you in touch with our partners at MKM + PARTNER Attorneys at Law for an initial, non-binding consultation.

The HinSchG does not apply to smaller companies until 17.12.2023 pursuant to Art. 10 HinSchG:

Companies employing 50 up to and including 249 employees will be subject to the legal obligations under the HinSchG from 17 December 2023.

However, companies with 250 or more employees are already exempt from the obligation to maintain an internal reporting office as of 02.07.2023.

Status: 01.08.2023

The original draft of the law, which was passed by the Bundestag on 15 December 2022, provided for protection that went beyond the requirements of the EU Directive in some places.

The latest amendments, which were decided in the mediation committee between the Bundestag and the Bundesrat, mean that the implementation in some places is more in line with the European requirement.

We present the most important points of the law here:

1. the material scope of application

While the Directive only protects whistleblowers in the case of violations of EU law, the HinSchG also applies to violations of federal and state law. There is still a list of individual areas of law or subject matter that are covered by the HinSchG.

Finally, the agreement in the Conciliation Committee resulted in a change to the definition of the term "information" that is reported: Accordingly, the information is now only relevant if the violations have been committed or are very likely to be committed at the employer where the whistleblower is or was employed or at another body with which the whistleblower is or was in contact due to his or her professional activities, as well as about attempts to conceal such violations.

2. the processing of anonymous reports

The obligation to set up a reporting channel that also allows anonymous reports, which was originally envisaged in the draft legislation, is no longer anchored in the HinSchG that has now been passed. However, in contrast to the EU Directive, the HinSchG also requires companies to process reports in which the whistleblower does not provide any personal information - so-called anonymous reports.

When choosing a solution, it is therefore recommended that anonymous two-way communication is ensured. - Please have a look at our White Sparrow platform!

3. personal meeting has been defused

The obligation to allow a face-to-face meeting if requested by the whistleblower has been alleviated: According to the Whistleblower Protection Act, the meeting can now also take place by means of video and audio transmission with the whistleblower's consent.

4. group solution remains in place

The legal committee emphasised the possibility of a group solution in the legislative process. This means that in groups of companies a central processing of the information, e.g. in a compliance team, remains possible. The prerequisite, however, is that the submission of the whistleblower is linguistically accessible and can be clearly assigned to a company. Insofar as national peculiarities arise from the respective laws of the EU countries, you have chosen the right platform with White Sparrow, as we have an eye on all implementations in the EU countries and take them into account in our platform - please feel free to make an appointment for a consultation.

5. extension of the retention period

Our data protection experts at MKM Datenschutz had already started early on to discuss with the supervisory authorities the deletion period of two years after the conclusion of the investigation, which in our view was too short. The legislator finally had a change of heart and at least upgraded it to the three years relevant for claims for damages. However, this is also likely to be structured differently within Europe.

The last amendment by the Conciliation Committee still brought the possibility with Section 11 (5) sentence 2 HinSchG to keep the documentation longer in order to fulfil the requirements according to the HinSchG or other legal provisions, as long as this is necessary and proportionate.

Status: 27.06.2023

● Are you an investment service provider (§ 2 para. 10 Securities Trading Act)?

● Are you a data provision service (§ 2 para. 40 Securities Trading Act)?

● Are you an exchange operating company within the meaning of the Stock Exchange Act?

● Are you a credit institution (section 1(1)(b) of the Banking Act)?

● Are you an institution within the meaning of section 2(1) of the Securities Institutions Act?

● Are you a capital management company (Section 18 (1) of the Capital Investment Code)?

● Do you fall under the Insurance Supervision Act (section 1(1) of the Insurance Supervision Act)?

● Are you a counterparty to a securities financing transaction?

If you answered "yes" to at least one of the questions, you are obliged to set up an internal reporting office regardless of the number of employees. If you are not sure, please feel free to contact us for a non-binding consultation.

Status: 27.06.2023

Once you as the client have provided all the onboarding information and - if there is a works council - the works council's co-determination rights have been respected, it only takes a few days to set up your whistleblower system. At the same time, an appointment will be made for the briefing of your team and, if desired, you will receive text templates to inform employees and partners.

The labour law experts at MKM Rechtsanwälte PartmbB will also be happy to support you in concluding a works agreement and negotiating with the works council.

Status: 27.06.2023

Our whistleblowing system guarantees the anonymity of the whistleblower and ensures that their identity cannot be traced by technical means. Technical data required for the transmission of the whistleblower is only accessible to a very limited group of people and only for a short period of time. The data is stored in highly secure data centres that are certified according to ISO 27001/2 and other standards. No IP addresses, location data, device specifications or other data that allow conclusions to be drawn about the whistleblower are permanently stored on these servers. 

The whistleblower decides whether to remain anonymous or to provide personal information. In any case, message content is only transmitted in encrypted form. In addition, all server communication takes place via an encrypted TLS 1.2.(HTTPS) connection.  External hosting IT service providers do not have access to the data.

Status: 16.02.2023

The following countries have already transposed the EU Directive into national law:

• Denmark
  Finland
  France
  Greece
  Ireland
  Croatia
  Latvia
  Lithuania
  Malta
  Portugal
  Romania
  Sweden
  Cyprus

The following countries have not yet transposed the EU Directive into national law:

• Belgium
  Bulgaria
  Germany
  Estonia
  Italy
  Luxembourg
  Netherlands
  Austria
  Poland
  Slovakia
  Slovenia
  Spain
  Czech Republic
  Hungary

Here you can download further information on the implementation status in Germany and other EU countries.

Status: 27.06.2023

The aim of the 2019 European Union Whistleblower Directive¹ is to achieve a uniform standard within the EU for the protection of whistleblowers in cases of corporate malpractice in relation to specific areas of law. By 17 December 2021, all EU member states should transpose this directive into national law. Read more about the background in our blog post on the Whistleblower Directive.

By transposing the EU directive into national law in all EU member states, the following should be achieved

• Violations of the law by and in companies can be detected and stopped more quickly.
• Whistleblowers are protected and not held liable under civil, criminal or administrative law or in relation to their employment
• improve law enforcement

¹Whistleblower Directive of the European Union

Status: 27.06.2023