In Germany, little importance was long attached to the protection of whistleblowers. Employees who encountered legal violations in their work often hesitated to report them or take action against them. The reason for this was the fear of negative consequences and discrimination. With the Whistleblower Protection Act, the federal government now aims to change this situation.European Whistleblower Directive (EU) 2019/1937.
The most important points in brief
- The new Whistleblower Protection Act (HinSchG) came into effect on July 2, 2023.
- Companies will be required to enable whistleblowing within a protected framework to address legal violations in the work context.
- Companies with over 50 employees had to effectively implement the legal requirements by December 17, 2023.
- Whistleblower systems process a variety of data, which is generally personal data within the meaning of Art. 4 No. 1 GDPR.
Background
A whistleblower is any natural person who has knowledge of violations or illegal activities within a company. These individuals play a crucial role by forwarding such information to internal reporting channels within the company or to external bodies, such as competent authorities. The provision of these tips is of great importance, as it helps to uncover grievances, unlawful acts, or unethical practices in companies. This protects not only the company itself but also society in general.
However, whistleblowers often expose themselves to significant risks when they uncover wrongdoing. They may face retaliation, reprisals, or stigma in the workplace or society. Given these risks, the introduction of a whistleblower protection law was urgently needed. This law aims to protect and provide security to individuals who act in the public interest and help address wrongdoing. It is intended to help whistleblowers act without fear of negative consequences. This not only ensures their individual safety but also makes an important contribution to maintaining transparency and integrity in companies and other organizations.
Implementing whistleblowing guidelines correctly
In Germany, a system has been established that enables employees of all companies to contact external reporting offices. These external reporting offices are usually specific federal or state authorities responsible for the respective issue. Examples include the Federal Office of Justice, the Federal Financial Supervisory Authority, or the Federal Cartel Office. These institutions serve as contact points for whistleblowers who wish to report misconduct in companies.
Companies with at least 50 employees are obligated to establish a secure internal reporting office. This can be done, for example, by setting up a special whistleblower system or by appointing a data protection officer who can also take on the function of the reporting office. These measures are intended to ensure that employees have a confidential and protected channel for reporting internal grievances.
The deadline for establishing such an internal reporting office expired on December 17, 2023. Until then, companies had time to implement the necessary systems and ensure they complied with legal requirements.
For larger companies with over 250 employees, the implementation of an internal whistleblowing system has been mandatory since the law came into effect on July 2, 2023.
Furthermore, in certain industries and sectors, the establishment of a whistleblower system is mandatory regardless of the number of employees. This includes companies in the financial services, healthcare, and energy sectors. Governments and public service also have this obligation.
The objective of the internal reporting office
The primary goal of the whistleblower protection system is to provide employees with the opportunity to report violations at any time, whether in writing, orally, or in person. It is of utmost importance that reports are handled confidentially. The identity of the whistleblower, as well as the individuals mentioned in the reports, must be strictly protected and kept from unauthorized disclosure. Employers also have the option to set up their reporting channels to accept anonymous reports if desired. However, the option for anonymous reporting is not legally required.
Every incoming report must be carefully documented. After a tip is submitted, it is required that the receipt of the report be confirmed to the informant within seven days. A detailed response, including information on any actions taken, must be provided within three months. This ensures that the process remains transparent and responsive.
The reported violations will be investigated based on the whistleblower's information. Following the investigation, appropriate follow-up actions must be taken to ensure that the reported violation is handled properly. Throughout this process, it is important to maintain regular contact, as requested by the whistleblower, to keep them informed of the progress.
The internal reporting office is obligated to inform the reporting person about the measures taken no later than three months after receiving the report. This ensures that the person who made the report is informed about the outcome and consequences of their report.
These measures help to ensure that the process of reporting violations is both effective and safe, and that the rights of whistleblowers are respected and protected.
The Role of Data Protection
When setting up internal whistleblower systems, it is essential for companies to consider data protection regulations. This is because the acceptance of reports through such systems regularly involves the processing of personal data. If the report is not made anonymously, this data includes information about the person making the report, detailed descriptions of the facts, including information about the accused and other involved persons, as well as information resulting from internal company investigations.
The legal basis for processing personal data is § 10 HinSchG.
Furthermore, the processing of data for incoming reports must be protected in accordance with the GDPR through appropriate technical and organizational security measures. This includes encrypting reporting forms according to the current technological standard and providing encrypted transmission for emails. Access to these reports must also be strictly controlled and granted exclusively to authorized personnel of the reporting office.
After a retention period of three years, the contents of received notifications should be deleted in accordance with Art. 17 para. 1 GDPR. This must be recorded and implemented accordingly in the company's own deletion concept.
Conclusion
Compliance with the Whistleblower Protection Act is crucial for companies. Violations of the essential provisions of this law are classified as administrative offenses. Depending on the nature and severity of the violation, fines of up to 50,000 Euros can be imposed. Therefore, it is of utmost importance to take the topic of whistleblowing seriously, especially from a data protection perspective. Companies are obliged to protect whistleblowers and simultaneously implement secure reporting systems. This is not only a legal requirement but also serves to continue benefiting from the valuable contributions of whistleblowers.
In addition to protecting whistleblowers, it is equally important to provide the necessary reporting channels. The absence of such channels can also be sanctioned. Therefore, companies should establish these reporting channels in a timely manner and establish clear processes for handling incoming reports. The Whistleblower Protection Act explicitly allows for the operation of the internal reporting channel by a qualified external service provider. This option can be a practical solution for companies to comply with legal requirements while conserving internal resources.
We are happy to offer our support if you have questions about whistleblower protection or would like advice on this topic. Expert advice can be crucial to ensure your company complies with legal requirements while creating a safe and supportive environment for whistleblowers. By taking the right steps, you not only contribute to the protection of whistleblowers but also strengthen the integrity and trust within your organization.
„>