Whistleblower Lawyers
in Germany

In October 2019, the EU adopted the “Whistleblower Directives”, which are intended to create a uniform standard for the protection of whistleblowers within the EU. The directives had to be implemented by the member states by 17 December 2021. This has been done in Germany with the Whistleblower Protection Act (HinSchG).

The Directive protects employees and other groups, such as former employees, trainees, and job applicants. Third parties associated with the whistleblower who could suffer reprisals in their professional environment because of the report are also covered by the scope of protection. Such persons who report breaches of the law during their professional activities should be primarily protected from reprisals. However, persons who knowingly report false or misleading information are excluded from such protection.

In a decision from 2001, the Federal Constitutional Court in Germany had already recognised a fundamental right to exercise civil rights through officially initiated whistleblowing under Article 2 (1) of the German Basic Law (GG) in conjunction with the principle of the rule of law under Article 20 (1) GG (BVerfG, decision of 2 July 2001 – 1 BvR 2049/00, NZA 2001, 888, 890). Insofar as information is passed on to law enforcement authorities that is not knowingly untrue or false, the employee must not suffer any disadvantages under employment law as a result.

However, as there were previously no legal requirements at a national level and the relevant terms were not subject to a standardised definition, the new Whistleblower Protection Act in Germany sets out specific regulations for dealing with whistleblowing for the first time.

Section 1 (1) HinSchG defines a whistleblower as a natural person who has obtained information about offences in connection with their professional activity or in the run-up to a professional activity and report or disclose them.

As an employer, you should implement the following measures provided for in the HinSchG without delay:

• Companies and organisations with 50 or more employees are obliged to set up and operate reliable internal whistleblowing systems. Smaller companies (between 50 and 249 employees) have an implementation deadline of 17 December 2023.
• Whistleblowers must be given the choice of submitting their reports verbally, in writing or in person.
• If a report is submitted, the whistleblower must receive confirmation of receipt within seven days. However, anonymous reports should also be followed up.
• The reporting office must inform the whistleblower of the measures taken (e.g. conducting an internal compliance review or forwarding a report to the competent authority/law enforcement agency) within three months.
• An external reporting centre will be set up at the Federal Office of Justice as an alternative option for submitting reports. In addition, the federal states can set up their reporting centres.
• To protect the whistleblower from reprisals, the law extensively reverses the burden of proof. If a whistleblower suffers noticeable disadvantages in their professional activity, it is assumed that this disadvantage will be regarded as a reprisal. In this case, the whistleblower may be entitled to claim damages.

Finally, the law provides for substantial fines for

• the disclosure of knowingly inaccurate information,
• failing to set up an internal reporting centre,
• obstructing a report,
• disregarding confidentiality.

The provisions on fines apply accordingly to the company concerned or the whistleblower, depending on the area of application. The HinSchG imposes obligations on both parties to protect the other party’s rights adequately. Section 40 HinSchG stipulates a maximum fine of €50,000.

Due to the current legal situation, companies with more than 249 employees are now obliged to set up confidential and effective whistleblowing systems or adapt existing systems to the requirements formulated in the Whistleblower Protection Act. The possibility of internal reporting benefits the company in particular, as it promotes the internal clarification of grievances and prevents reputational damage. The company is also protected from legal and economic damage, as whistleblower systems serve to review compliance and thus contribute to its improvement.

At the same time, it should be emphasised, particularly regarding internal reports, that there are no consequences for the reporting employee if they use the reporting office. If the employee feels more comfortable and confident in not using the internal reporting centre, this is also not associated with any disadvantages. They are free to choose whether to report violations by the company internally or externally.

To ensure that the chosen whistleblowing system complies with legal requirements, the applicable ISO norms, and, in particular, data protection regulations, it is advisable to seek advice from an experienced lawyer. Thanks to our interdisciplinary approach, we can offer your company reliable and competent legal advice on all compliance requirements. Our team supports your company in setting up and operating whistleblowing systems and ensures that the extensive requirements regarding the protection of whistleblowers are met following the law.

The processing of whistleblower reports always involves processing the personal data of the whistleblower and the accused persons. Therefore, Data protection regulations are crucial in establishing and operating internal whistleblowing systems. Data collection through internal investigations is subject to the applicable provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

A legal basis is required to ensure the collection and processing of personal data in compliance with data protection regulations. In addition to the conditions laid down in Art. 6 para. 1 GDPR for the lawfulness of processing, Art. 88 GDPR in conjunction with Section 26 (5) BDSG or Section 10 HinSchG could form the legal basis for data processing.

Furthermore, the confidentiality requirement under Section 8 HinSchG and the rights of data subjects under the GDPR must be observed. If a whistleblower collects personal data without the knowledge of the accused person, the processor must, therefore, fulfil the obligation to provide information following Art. 14 GDPR. Accordingly, the accused person must be informed of the whistleblower’s identity within one month of the report at the latest (Art. 14 para. 3 letter a) GDPR). However, under certain conditions (see Section 14 (5) GDPR and Section 29 (1) sentence 1 BDSG), an exception can be made to the obligation to provide information. This also applies to the right to information under Art. 15 GDPR (cf. Section 29 para. 1 sentence 2 BDSG).

Our German IT lawyers advise you on implementing data protection regulations when setting up whistleblowing systems.

Since whistleblowing is directed against the whistleblower’s employer, there is a fear of consequences under employment law, particularly dismissal, and the question of which consequences under employment law could be drawn. The HinSchG sets out clear rules on this. Section 36 HinSchG provides for a ban on reprisals:

(1) Reprisals directed against whistleblowers are prohibited. This also applies to threats and attempts to take reprisals.

(2) If a whistleblower suffers a disadvantage in connection with their professional activity and claims to have sustained this disadvantage due to a report or disclosure under this Act, it shall be presumed that this disadvantage is a reprisal for this report or disclosure. In this case, the person who has victimised the whistleblower must prove that the victimisation was based on duly justified grounds or not on the report or disclosure.

The prohibition of reprisals covers all conceivable disadvantages, such as the denial of a promised promotion, a change in the assignment of duties to the detriment of the whistleblower, disciplinary measures, warnings, and any form of discrimination. Due to the reversal of the burden of proof stipulated in paragraph 2, it would be up to the company to prove that the whistleblower’s unfavourable treatment is unrelated to a report or disclosure. If reprisals are imposed, the company is obliged to compensate the whistleblower.

This protection applies if the whistleblowing is lawful. The requirements for whistleblower protection are now regulated in the HinSchG instead of being derived from general provisions of the German Civil Code (BGB). Only if the whistleblower complies with the intended regulations for reports and disclosures will they benefit from the scope of protection afforded by the regulations.

Our German employment lawyers will provide competent advice in all employment law matters, out of court and, if unavoidable, in court.

The Act on the Protection of Trade Secrets (GeschGehG), which came into force on 26 April 2019, is also relevant for dealing with whistleblowers. According to this law, trade secrets may not be disclosed, Section 4 (2) and (3) GeschGehG. Section 6 (1) HinSchG regulates the relationship between whistleblower protection and trade secret obligations. Accordingly, the disclosure of a trade secret in the sense of a report or disclosure is permitted, provided that

1. the whistleblower had reasonable grounds to believe that the communication or disclosure of the content of this information was necessary to detect a violation and
2. the requirements of Section 33(1)(2) and (3) are met, i.e. the whistleblower had reasonable grounds to believe at the time of reporting or disclosure that the information reported or disclosed by them was true and the information concerned breaches within the scope of this Act, or the whistleblower had reasonable grounds to believe at the time of reporting or disclosure that this was the case.

The German Law on the Protection of Trade Secrets contains a criminal provision stating that the violation of trade secrets is punishable under Section 23 GeschGehG. Anyone who obtains, uses, or discloses a trade secret in breach of the Trade Secrets Protection Act to promote their own or third-party competition, for their benefit, for the benefit of a third party, or to harm the owner of a company is liable to a prison sentence of up to three years or a fine.

Concerning the disclosure of trade secrets, there are further criminal provisions in addition to the offence under Section 23 GeschGehG. For example, according to Section 85 (1) of the German Act on Limited Liability Companies (GmbHG), anyone who discloses a secret of a company without authorisation, which has become known to them in their capacity as a managing director, supervisory board member or liquidator, is to be punished. A comparable provision can be found in Section 404 of the German Stock Corporation Act (AktG) for members of the management board, supervisory board, liquidators, or auditors of a public limited company. Other criminal offences are standardised in Section 331 (1) of the German Commercial Code (HGB) and Section 315 of the German Transformation Act (UmwG).

In addition, the German Criminal Code (StGB) contains several provisions on the criminal liability of whistleblowers. For example, the disclosure of state secrets is criminalised in Sections 93 et seq. StGB. In addition, Sections 353b, 355 para. 1 sentence 1 no. 2 StGB criminalise the betrayal of secrets by public officials. Furthermore, Section 203 StGB defines a criminal offence for betraying trade secrets. Very general criminal offences can also be fulfilled by disseminating incorrect information. This includes a charge of pretending to commit a criminal offence under Section 145d StGB, false accusation under Section 164 StGB and defamation under Section 187 StGB. In addition to potentially relevant criminal offences, the HinSchG includes disseminating false information in the catalogue of fines, which is punishable by a fine of up to €20,000.

Disclosing criminally protected secrets may be justified under certain circumstances, so criminal sanctions do not apply. If it is an internal report, it can generally be assumed that the employer who has set up the whistleblowing centre has consented under German criminal law. As there is, therefore, no illegality, criminal liability cannot be considered in this case.

In addition, the disclosure of protected information may be justified by a defensible state of emergency following Section 34 StGB. The prerequisite for this is a present danger to life, limb, freedom, honour, property, or another legal interest capable of justifying a state of emergency. In particular, the disclosure must have been necessary to avert the danger. For this reason, internal reporting generally takes precedence as a milder means. In addition, the conflicting interests must also be weighed up here. The justification of the disclosure of business secrets according to Section 5 No. 2 GeschGehG refers only to the prohibitions of action under Section 4 GeschGehG and is, therefore, not a general justification.

If you are threatened with criminal proceedings for whistleblowing, please contact our law firm immediately. Our experienced German criminal lawyers will be at your side every step of the way and provide you with skilled and committed criminal defence.