The EU Whistleblower Directive: What are the Consequences for Companies?

At the end of October 2019, the EU adopted the “Directive on the Protection of Persons Reporting Breaches of EU Law”, also known as the Whistleblower Directive. The aim of Directive (EU) 2019/1937 is to create a uniform standard within the EU to protect whistleblowers. Whistleblowers who report legal violations in the course of their professional activities are to be largely protected from reprisals.

The EU states only have until 17th December 2021 to transpose the directive into national law. In Germany, the implementation is to take place through a Whistleblower Protection Act, for which there is already a draft. However, the legislative process is currently at a standstill due to disagreements. It remains to be seen when and how the German legislature will implement the EU Whistleblower Directive concretely. However, since the directive already contains some precise requirements, companies can and should already orient themselves to them and set up appropriate whistleblower systems. But what do these requirements look like and how should companies prepare for the incoming law changes?

Who is Protected by the Whistleblower Directive?

The personal scope of protection of the Directive results from Article 4. Firstly, it covers whistleblowers who are active in the private or public sector and who bring legal violations to the attention of their company in the course of their professional activities. They are to be protected from reprisals. This protection applies not only to employees but also, for example, trainees, job applicants and former employees.

In addition, third parties connected to the whistleblower and could suffer reprisals in the professional context also fall within the scope of protection. These third parties may include, for example, a spouse of the whistleblower who has the same employer. The Directive thus provides for a broad personal scope of protection.

However, good faith is required for the right to protection to exist. The whistleblower must have sufficient reason to believe that his report is accurate (cf. Art. 6 para. 1 lit. a of the Directive). On the other hand, anyone who willingly and knowingly reports false or misleading information is not protected (Prelude 32 of the Directive). It should also be noted that the whistleblower’s motives for reporting wrongdoing should be irrelevant for their protection, as follows from Preamble 32 of the Directive. This development is a change concerning German case law, according to which the whistleblower’s motivation plays a role in the legality of the report.

Which Reports are Covered by the Protection of the Directive?

Due to the limited legal competence of the EU, the Whistleblower Directive only covers whistleblowers who report wrongdoing that has a bearing on EU law. It only covers reports of violations of those areas of EU law that are listed in the Directive. These include, for example, public procurement, tax fraud, money laundering, environmental protection, protection of privacy and personal data, and security of network and information systems.

However, Art. 2 para. 2 of the Directive explicitly allows EU states to extend the scope of application within the framework of national transposition laws. The draft of the Whistleblower Protection Act also includes information on violations of German law. There are to be uniform regulations for whistleblowers regarding breaches of EU law and national law. It remains to be seen, however, whether the draft will prevail.

Choice of Whistleblower: Internal or External Reporting

According to the Directive, whistleblowers have the choice of reporting whistleblowing information internally within the company or directly to the competent supervisory authority. These two ways of reporting are of equal importance. This development is another change in German law because, according to the previous legal situation in Germany, internal reporting had priority over external reporting. The fact that whistleblowers can in future decide to contact the authorities directly poses risks for the reputation of companies in particular.

In addition, whistleblowers can also turn to the public under certain conditions (cf. Art. 15 of the Directive). Turning to the public is allowed, for example, if grievances have already been reported internally and externally or by direct external means, but the whistleblower has received no feedback within a certain period. Whistleblowers can also turn to the public if there is sufficient reason to believe in a public interest.

What are the Legal Obligations for Companies?

The Whistleblower Directive stipulates that companies with 50 or more employees must establish appropriate channels and procedures for internal reporting (Art. 8 para. 1, 3 of the Directive). These reporting channels can either be operated internally or provided externally by a third party. The implementation of effective whistleblowing systems not only benefits whistleblowers but also pays off for companies. In this case, a whistleblower is more likely to choose the internal reporting route instead of going directly to the relevant supervisory authority. This development allows the company to review and resolve the matter internally.

The Directive also specifies some requirements for internal reporting procedures. In particular, they must be secure, confidential reporting systems to protect the whistleblower’s identity (Art. 16(1) of the Directive). In addition, the company must acknowledge receipt of a report within seven days. Subsequently, the whistleblower must be informed at the latest after three months about the measures planned or already taken concerning the report (Art. 9 para. 1 of the Directive).

It should be noted that for companies with 50 to 249 employees, an extended implementation period until 17.12.2023 applies. Nevertheless, companies should make preparations for compliance systems as early as possible to keep liability risks low.

What are the Protections for Whistleblowers?

EU states are obliged to prohibit any reprisals against whistleblowers (Art. 19 of the Directive). This prohibition includes, for example, dismissal, warning, transfer of tasks, negative performance appraisal, demotion and other discrimination. The Directive contains a non-exhaustive list of reprisals.  In addition to actual reprisal, its threat and attempt are also prohibited.

Another measure to protect whistleblowers is the reversal of the burden of proof in judicial and administrative proceedings provided for in Article 21(5) of the Directive. According to this, it is not the whistleblower who bears the burden of proof that a disadvantage has occurred due to whistleblowing. Instead, the body that has taken the disadvantageous measure must prove that it is not an inadmissible reprisal due to whistleblowing. This regulation also represents a change concerning German law, according to which the whistleblower previously bore the burden of proof.

The requirements on the burden of proof could become problematic for companies. For example, the reversal of the burden of proof could lead to employees reporting wrongdoing in their company shortly before impending dismissals to obtain additional protection against dismissal (Dzida/Granetzny: Die neue EU-Whistleblowing-Richtlinie und ihre Auswirkungen auf Unternehmen, NZA 2020, 1201, 1204). Then the employer would have to prove that the dismissal was not due to the report but for other reasons. Therefore, it is advisable to carefully document all circumstances that could lead to measures under labour law, such as dismissal or other disciplinary actions.

The Threat of Sanctions

Furthermore, the Directive provides for sanctions for persons who obstruct or attempt to obstruct reports, take reprisals or fail to protect the confidentiality of whistleblowers’ identities (Art. 23 of the Directive). European Union Member States are obliged to introduce appropriate sanctions that are effective, proportionate and dissuasive. This threat of sanctions also applies to whistleblowers who are proven to have knowingly reported false information.

Here, too, it depends on the German legislator what these sanctions will look like in concrete terms. The draft of the Whistleblower Protection Act classifies some violations as administrative offences and provides for fines of up to 100,000 euros.

How Should Companies Prepare?

The Directive still has to be transposed into national law by the German legislator. However, it already makes some sufficiently concrete specifications that companies should already take into account.

In addition, it should not be ignored that the EU Whistleblower Directive could have a de facto influence on companies even before its implementation into national law. This is because case law could adapt to the Directive’s requirements by way of interpreting German law in conformity with European law (Dzida/Granetzny: Die neue EU-Whistleblowing-Richtlinie und ihre Auswirkungen auf Unternehmen, NZA 2020, 1201, 1204; Ruffert, in: Calliess/Ruffert, 5th ed. 2016, TFEU, Art. 288 marginal no. 80).

Therefore, it is advisable to implement the corresponding requirements for the establishment of a whistleblower system as early as possible. Even if whistleblowing systems already exist, they should be reviewed to determine whether they comply with the Directive’s requirements and, if necessary, adapted. Finally, confidential and straightforward reporting systems also serve the company itself by preventing reports to authorities. Thus, efficient and secure whistleblowing systems benefit whistleblowers and help to minimise liability risks and thus protect the company.

What is the Current Legal Situation in the Area of Whistleblower Protection in Germany?

Up to now, employees have been protected by the general prohibition of measures under § 612a German Civil Code (BGB). According to this, the employer may not discriminate against an employee if the employee has exercised their rights in a permissible manner. This protection applies in the case if the whistleblowing is lawful. However, the burden of presentation and proof concerning the fact that a disadvantageous measure was taken based on a permissible exercise of rights currently lies with the employee (cf. BAG, judgement of 18.10.2017 – 10 AZR 330/16, NZA 2017, 1452 marginal no. 42).

Whether whistleblowing is lawful is assessed by case law by weighing the employer’s interest in secrecy against the employee’s legitimate interest in reporting the grievance. It must also be considered that internal reports generally have priority due to the employee’s duty of loyalty. An exception may exist, for example, if remedial action is not to be expected. (BAG, Urt. v. 3.7.2003 – 2 AZR 235/02, NZA 2004, 427, 430) The outcome of such a weighing is often not easy to foresee so that the implementation of the Whistleblower Directive will lead to more legal certainty.

Apart from general protection under labour law, some industry-specific regulations impact whistleblowing. For example, the General Equal Treatment Act contains regulations (§§ 13, 27; § 16 AGG). Further regulations can be found, for example, in § 17 para. 2 ArbSchG, §§ 84 et seq. BetrVG, § 67 (2) no. 3 BBG, § 25a (1) sentence 3 no. 3 KWG and § 48 GWG.

Furthermore, the Act on the Protection of Business Secrets (GeschGehG) is also relevant for protecting whistleblowers. According to this law, employees may not disclose business secrets in principle. However, § 5 No. 2 GeschGehG protects whistleblowers by providing for exceptions. According to this, the disclosure of a trade secret to uncover an unlawful act or professional or other misconduct is permissible, provided that this is suitable for protecting the general public interest.

Legal Advice from a Full-Service Law Firm

How the protection of whistleblowers in Germany will change depends on how the German legislator will implement the EU Whistleblower Directive. However, the Directive as a whole will inevitably provide for some new regulations in German whistleblower protection law. The Directive will expand the protection for whistleblowers, and companies will be held more accountable. In particular, there is a danger for companies that employees will increasingly refrain from internal clarification in the future and instead turn directly to the relevant authorities. For this reason, it is advisable to start now with the establishment or expansion of confidential and effective whistleblower systems to promote internal reporting.

Schlun & Elseven Rechtsanwälte PartG mbB is a full-service law firm operating throughout Germany. Our team provides expert advice to you and your company on setting up and operating whistleblowing systems and all compliance requirements. We ensure that your company complies with the extensive requirements for the protection of whistleblowers and that, at the same time, grievances can be effectively remedied internally.