Implementation of the EU Whistleblowing Directive in Germany.

Existing whistleblower protection

In Germany, whistleblower protection is currently considered to be limited. So far, whistleblower protection has been shaped primarily by case law. In particular, civil and labour courts are guided by the requirements of the European Court of Human Rights (ECHR). There are currently only national regulations on whistleblower protection for the financial services sector (sec. 4d para. 6 FinDAG) and regarding the protection of business secrets (sec. 5 GeschGehG).

Implementation perspective and recommended actions for German employers

In order to implement the Directive and harmonise the legal principles developed by the courts regarding whistleblowers, the German government developed a draft general law on whistleblower protection on 11 December 2020, which deliberately goes beyond a mere implementation of the EU Directive.

The draft law has so far been controversial among the governing parties in Germany, and it has yet to be decided whether and how it will actually be implemented. However, the aim is to reach an agreement by the end of the implementation period of the EU Directive on December 17, 2021 at the latest.

However, implementation of the EU Directive in Germany is not expected until the next legislative period due to the upcoming federal elections in autumn 2021. Therefore, it can currently be assumed that implementation into German law will not take place within the set deadline of 17 December, 2021. As the EU Directive is sufficiently precise and specific, whistleblowers in Germany could possibly rely directly on the EU Directive after 17 December 2021.

Given this background, employers are strongly recommended to prepare for the implementation of a whistleblowing system that meets the requirements of the EU Directive as a minimum standard.

German draft law on whistleblower protection

The draft law primarily intends to create legal clarity for whistleblowers as to when and how they are protected when reporting or disclosing violations. Further, it will clarify for businesses and administrations how to deal with a report and the legal consequences.

The main aspects of the draft are:

  • Covered Persons: All persons who have obtained information about violations in their professional environment and those connected to them in a work-context (colleagues) are covered by the draft law. In contrast to the Directive, there is no specific list of the protected group of persons; only the purely private acquisition of information is excluded.
  • Relevant disclosures: The material scope takes up the areas of law specified by the EU Directive, extended to corresponding national law. In particular, this includes national criminal law and the national law governing administrative offences.
  • Legal consequences: Provided that the whistleblower could rightfully assume that the information disclosed was true, they are extensively protected against any reprisals and detriments, such as dismissals. Here, also, contrary to the EU Directive, the reprisals are not set out -- the draft act provides protection against any act or omission connected with the professional activity where it is a response to a whistleblowing report. In case of reprisals or detriments, it is for the employer to prove these were not related to the whistleblowing, but were based on other, sufficiently justified reasons. If the employer fails to prove this, there is an obligation to compensate the whistleblower for the disadvantage resulting from the unfavourable treatment.
  • Reporting:
    • Federal Financial Supervisory Authority (BaFin) acts as external reporting authority and country level oversight for specific violations (eg against provisions of the Securities Acquisition and Takeover Act or violation of the rights of shareholders of public limited companies).
    • Internal and external reporting channels shall be provided, constituting two equal reporting channels that can be freely chosen by the whistleblower.
    • There shall be no obligation for reporting authorities to process/track anonymous reports. According to the EU Directive, this decision was left to the Member States.
  • Confidentiality: Implementing the requirements of the EU Directive and in compliance with the case law of the ECHR, the identity of the whistleblower must not be disclosed without explicit consent to anyone beyond those dealing with the report. Furthermore whistleblowers who disclose information to the public are only protected if there was no timely response on external reporting, reasonable expectation of imminent risk to public interests and otherwise ineffective external reporting.
  • Prescribed timeframe: Prescribed timeframe: Deadlines to be observed by employers when receiving whistleblower complaints in accordance with the EU Directive:
    • 7-day deadline for confirmation of receipt;
    • 3-month deadline for response on measures/reasons.

Originally published 27 July 2021

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.