Whistleblower Lawyers
in Germany

In contrast to other countries, Germany does not yet have a uniform whistleblower law that regulates the handling of whistleblowing. Instead, there are many sector-specific regulations in a number of different laws, so it is not easy to keep track of them all. This page is intended to give you an insight into what needs to be considered in connection with whistleblowing in Germany.

First of all, an important fundamental decision for the protection of whistleblowers in Germany: In a decision in 2001, the Federal Constitutional Court recognised a fundamental right to exercise civic rights by way of authority-directed whistleblowing under Article 2 (1) of the Basic Law in conjunction with the principle of the rule of law under Article 20 (1) German Constitution (BVerfG, decision of 2 July 2001 – 1 BvR 2049/00, NZA 2001, 888, 890). Provided that information is passed on to criminal prosecution authorities which is not knowingly untrue or recklessly false, the employee must not suffer any disadvantages under labour law as a result.

Companies should be protective and seek to set up confidential and effective whistleblower systems or adapt existing systems to the requirements of the EU Whistleblower Directive. Companies themselves in particular benefit from their preventive effect, as the internal clarification of grievances is promoted and can prevent reputational damage. The company is also protected from legal and economic damage, as whistleblower systems serve to check compliance and thus contribute to its improvement.

To ensure that the procedure complies with the legal requirements and, in particular, the provisions of data protection law, it is advisable to seek advice from an experienced lawyer. Schlun & Elseven Rechtsanwälte PartG mbB is a full-service law firm operating throughout Germany. Due to our interdisciplinary orientation, we can provide your company with reliable and expert advice on all compliance requirements. Our team will be happy to advise and support you in setting up and operating whistleblower systems and ensure that your company complies with the extensive requirements for the protection of whistleblowers.

Concerning the disclosure of trade secrets, there are further criminal law provisions in addition to the criminal offence of § 23 GeschGehG. Thus, according to § 85 (1) GmbHG, anyone who unauthorisedly discloses a company’s secret that has become known to them in their capacity as managing director, member of the supervisory board or liquidator is to be punished. A comparable provision is found in § 404 AktG for executive board members, supervisory board members, liquidators or auditors of a public limited company. Other conditions under criminal law include § 331 para. 1 HGB and § 315 UmwG.

The German Criminal Code (StGB) also contains several provisions on the criminal liability of whistleblowers. For example, the disclosure of state secrets is regulated in §§ 93 ff. StGB. In addition, §§ 353b, 355 para. 1 sentence 1 no. 2 StGB criminalise the betrayal of secrets by public officials. § 203 StGB contains a criminal offence for the disclosure of business secrets.

The disclosure of secrets protected by criminal law may be justified under certain circumstances so that criminal sanctions do not apply. If it is an internal report, consent in the criminal law sense can usually be assumed to have been given by the entrepreneur who set up the whistleblowing office (Wissenschaftliche Dienste, Deutscher Bundestag, 26.4.2019, WD 7 – 3000 – 075/19, p. 5). In the absence of illegality, criminal liability does not apply in this case.

Furthermore, the disclosure of protected information may be justified based on justifiable necessity according to § 34 German Criminal Code. The prerequisite for this is the existence of a present danger to life, limb, freedom, honour, property or another legal asset capable of justifying an emergency. In particular, the disclosure must have been necessary to avert the danger. For this reason, internal reporting as a milder means usually takes precedence. Moreover, a balancing of the conflicting interests is required here as well. (Cierniak/Niehaus, in MüKo StGB, 4th edition 2021, § 203, marginal no. 101) The justification of the disclosure of business secrets according to § 5 no. 2 GeschGehG explicitly refers only to the prohibitions of action of § 4 GeschGehG. Therefore, it is not a general justification (Hiéramente, in BeckOK GeschGehG, 8th edition as of 15.6.2021, § 1, marginal no. 24).

If you are facing criminal proceedings, our experienced lawyers for criminal law will be happy to help you. We will be by  side every step of the way and will ensure expert criminal defence.

Dealing with whistleblower reports always involves processing the personal data of the whistleblower and the accused persons. Therefore, data protection regulations play an essential role in establishing and operating internal whistleblowing systems. The applicable regulations of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) must be complied with under German law. It should first be noted that whistleblower systems constitute procedures in which data protection officers must be appropriately involved at an early stage in all matters relating to the protection of personal data, according to § 38(1) GDPR (Fassbach/Hülsberg, GWR 2020, 255).

If personal data is collected without the knowledge of the person accused by a whistleblower, the processor must comply with the information obligation under § 14 GDPR. According to this provision, the accused person must, in principle, be informed of the identity of the whistleblower within one month of the notification at the latest (§ 14(3)(a) GDPR). However, if there is a risk that this would jeopardise the investigation of the report, the information may be withheld. This withholding of information only applies as long as the threat of jeopardising the investigation exists.

Potential whistleblowers should be made aware of the obligation to provide information and the confidential processing of personal data before they contact the whistleblowing system (Fassbach/Hülsberg, GWR 2020, 255). If the whistleblower wishes to disclose their identity even after being informed, their consent may be considered the basis for processing their data under § 6 (1) sentence 1 lit. a, § 7 GDPR. However, it must be noted that the person providing the information must be informed that they can revoke their consent at any time (§ 7 para. 3 GDPR).

In addition to the right to information about the circumstances of the data processing, the accused person also has a right to access their personal data (§ 15 GDPR). The right to information is limited by § 29 (1) sentence 2 BDSG. According to this, the claim does not exist if the information would disclose information that must be kept secret according to a legal provision or in particular due to the overriding legitimate interests of a third party.

Our specialised lawyers will be happy to advise you on implementing data protection provisions when setting up whistleblower systems.

In German labour law, the question arises under what circumstances an employer can dismiss an employee for external whistleblowing. Generally speaking, employees are protected by the general prohibition of victimisation under § 612a German Civil Code (Bürgerliches Gesetzbuch – BGB). According to this regulation, the employer may not discriminate against an employee if the employee has exercised their rights in a permissible manner. This protection applies in the case that the whistleblowing is lawful. However, the burden of presentation and proof concerning the fact that a victimisation measure was taken based on a permissible exercise of rights currently lies with the employee (cf. BAG, judgement of 18.10.2017 – 10 AZR 330/16, NZA 2017, 1452 marginal no. 42).

Whether whistleblowing is lawful is assessed by case law by weighing the employer’s interest concerning trade secrecy against the employee’s legitimate interest in reporting the grievance. The employee’s contractual duty of consideration under § 241 (2) BGB (German Civil Code), according to which the employee must show consideration for the business interests of their employer and protect trade and business secrets, plays a vital role in this context (BAG, judgement of 3 July 2003 – 2 AZR 235/02, NZA 2004, 427, 429 f.).

For the reasons stated above, the principle of priority of internal reports also applies unless the employee cannot reasonably be expected to accept internal clarification (BAG, Judgement of 3 July 2003 – 2 AZR 235/02, NZA 2004, 427, 430).  This may be the case, for example, if remedial action is not to be expected. In addition, the employee cannot reasonably be expected to make a prior internal report if they have knowledge of such offences, the non-reporting of which would expose them to the risk of criminal prosecution. Even if the employer is aware of serious criminal violations, or if the criminal offences have been committed by the employer, there is regularly no duty of consideration.

The specialist lawyers for labour law at Schlun & Elseven can provide you with competent advice in German labour law matters both out of court and, should it be unavoidable, in court.

In October 2019, the EU adopted the “Whistleblower Directive”, which aims to create a uniform standard for protecting whistleblowers within the EU. The implementation of the Directive by the Member States must take place by 17 December 2021, which is to be done in Germany by drafting a Whistleblower Protection Act. However, it remains to be seen precisely how the implementation will take place.

The Directive protects employees and other groups, for example, former employees, trainees, and job applicants. Third parties associated with the whistleblower who could suffer reprisals in the professional context due to the whistleblowing are also covered by the scope of protection. Such persons who report violations of the law in the course of their professional activities are to be largely protected from any reprisals. However, persons who knowingly report false or misleading information are excluded from protection.

A significant innovation with current German law is that whistleblowers are to have the choice of reporting information internally or directly to the competent supervisory authority. In addition, companies with 50 or more employees must establish appropriate reporting channels and procedures for whistleblowers. Companies should already orientate themselves to this requirement to comply with the future legal regulations and promote internal reporting for the protection of the company.

There are many industry-specific regulations in German law regarding the admissibility of whistleblowing and the protection of whistleblowers, but no uniform whistleblower law. However, this could change within the framework of the implementation of the EU Whistleblower Directive, which is to take place in Germany by way of a Whistleblower Protection Act.

Some provisions standardise whistleblower rights, such as §§ 84 and 85 of the Works Council Constitution Act (BetrVG) (which regulate the right to complain to the works council) or § 17 (2) of the Labour Protection Act (ArbSchG) and § 27 (1) General Act on Equal Treatment (AGG). In addition, there are provisions that exempt whistleblowers from liability and protect them from discrimination, such as § 48 GWG. This also applies to § 17 para. 2 ArbSchG, which protects employees who turn to the competent authority because of inadequate safety and health protection guarantees at work.

In principle, companies are not yet obliged to set up a whistleblower system. However, an exception exists for credit institutions according to § 25a, para. 1, sentence 6, no. 3 German Banking Act (KWG). Accordingly, it is part of proper business management to set up a confidential system for reporting violations of legal regulations concerning credit institutions and any criminal offences. However, even if the establishment of whistleblower systems is not required by law, it can be recommended. After all, such systems ensure compliance with the rules within the company and can prevent employees from turning to the outside world directly with information about internal malpractices.

In addition, the Act on the Protection of Business Secrets (GeschGehG), which came into force on 26 April 2019, is also relevant for dealing with whistleblowers. According to this law, business secrets may not be disclosed as a matter of principle (§ 4(2), (3) GeschGehG). However, § 5(2) GeschGehG provides for exceptions and thus protects whistleblowers under certain circumstances. According to this, the disclosure of a trade secret is permissible for the purpose of uncovering an unlawful act or professional or other misconduct, provided that this is suitable for the protection of the general public interest.

§ 6 et seq. GeschGehG regulates civil claims against the disclosing party, provided that there is a legitimate interest in protecting the trade secret. If there is an infringement of rights, § 6 GeschGehG forms the legal basis for injunctive relief and removal claims by the trade secret owner. In addition, the trade secret owner may demand the destruction or surrender of documents, objects or electronic files containing or embodying the trade secret (§ 7 no. 1 GeschGehG). In addition, the trade secret owner has a claim for damages if the act was intentional or negligent (§ 10 GeschGehG). Accordingly, non-pecuniary damages are also compensable, which include, in particular, damage to reputation.

The Business Secrets Act also contains a provision under criminal law. According to § 23 GeschGehG, the violation of trade secrets is punishable. For example, anyone who obtains, uses or discloses a trade secret in breach of the Protection of Business Secrets Act to promote their own or another’s competition, for their own benefit, for the benefit of a third party or with the intention of causing damage to the owner of a company is liable to a custodial sentence of up to three years or a monetary penalty.