Update Whistleblower Protection Act
The law applies to companies with 250 or more employees immediately after it comes into force. Companies with 50 or more employees must have an internal whistleblower system in place from 17.12.2023. Companies with fewer than 50 employees are excluded from the scope of application, with exceptions in sensitive areas such as banking. The requirements for the internal whistleblower system are varied and in many cases not clearly formulated by the legislator. Provision is made for the appointment of an internal reporting office. This is either a person employed by the respective company or a work unit that is entrusted with the tasks of an internal reporting office. An external third party can also take on the role of internal reporting office. The reporting office must have the necessary expertise, operate the reporting channel, manage the procedure, maintain confidentiality and take follow-up measures. It is the link between the whistleblower and the company. The reporting office is independent in its activities and must not be bound by instructions.
The reporting channel must also meet a number of requirements, in particular ensure confidentiality and comply with data protection regulations. It must be designed in such a way that reports can be made both verbally and in writing. At the request of the whistleblower, a personal meeting must also be possible, which can also take place by telephone. The acceptance of anonymous tip-offs is only a mandatory requirement, but should be permitted for compliance reasons. The identities of the whistleblower and the persons affected by the report are subject to special protection. The identity may only be disclosed to employees who are responsible for handling the report.
There are exceptions, for example, if investigations are carried out as part of the criminal prosecution of the report. In view of the strict legal requirements, a digital system is the most suitable whistleblowing system in order to comply with the requirements in the best possible way. Digital solutions usually also include the necessary deadline management, as incoming reports must be confirmed within seven days and whistleblowers must receive substantiated feedback within three months as to what measures have been taken. The law also stipulates a documentation obligation, which can also be most easily mapped using a digital system. If there is a representative body (works council, employee representative body) in the company, it must be properly involved in the implementation.
The internal whistleblower system must be accessible to at least all employees and temporary workers. However, the personal scope of application of the HinSchG is broader and includes all persons who have obtained information about violations in connection with their professional activities, e.g. customers and suppliers. It should therefore be considered whether these persons should also be granted access. Otherwise, there is a risk that they will turn to external, official reporting bodies.
The material scope of the law initially refers to all reports of criminal offenses. However, violations that are only subject to fines are also covered if the violated regulation serves to protect life, limb or health or to protect employees. In individual cases, it will therefore be difficult to decide whether a violation is subject to whistleblower protection at all.
The grace period is (soon) over. Companies that fall within the scope of application should start implementing the Whistleblower Protection Act now at the latest. Companies that do not comply with the legal requirements can expect to face severe fines of up to EUR 50,000. A small ray of hope: The regulatory offense provision will only be applied from 01.12.2023.
VOELKER will be happy to support you in all legal areas relating to the introduction of a whistleblowing system. Within the VOELKER Group, we offer you not only legal advice from our specialist lawyers, but also the technical implementation of a secure, legally compliant whistleblowing system. If you are interested in our offer, please do not hesitate to contact me. You can reach me by telephone on 07433 26026-15 or by e-mail: n.kirsch@voelker-gruppe.com