The German Whistleblower Protection Act

I. Legal objective of the Protection Act

In addition to the obligation to implement the EU Directive, the Protection Act is necessary as currently Germany has no specific legal protection for whistleblowers. There is a tension between the employee's duty of loyalty to the employer and the public interest in clarifying violations of the law. A whistleblower contributes to this clarification by reporting violations. Due to the unclear legal situation, a whistleblower risks termination of employment or other labour law measures under current German law. The EU Directive and the Protection Act take this into account by protecting whistleblowers from employer reprisals. If a whistleblower suffers adverse action in connection with their professional activities following a report or disclosure, such adverse action is presumed to be reprisal.

The Protection Act protects from reprisal any person who has received information about violations in connection with their professional activities or in advance of professional activities, and who reports or discloses such information to designated reporting channels. The Protection Act applies to the reporting of EU law violations or certain national regulations that are subject to sanctions or fines.

II. Reporting channels

The Protection Act provides that a whistleblower may make a report to an internal or external reporting channel. The Federal Ministry of Justice is responsible for providing an external reporting channel. Any company with more than 50 employees is required to operate an internal reporting channel. Companies with 50 to 249 employees may operate a so-called “joint reporting channel”. But any company with more than 249 employees is obliged to establish and operate their own reporting channel and is precluded to run a joint reporting channel with another company. It should be noted that companies with fewer than 50 employees also fall under the Protection Act. However, the external reporting channel is responsible for these companies. Finally, there is no obligation to design reporting channels to facilitate anonymous reporting. Also, anonymous reports should only be processed to the extent that they do not jeopardise the processing of identified reports.

Unfortunately, the Protection Act does not prioritise internal reporting channels over external reporting channels, although the EU Directive clearly provides for this in Article 7 (2). Rather, the whistleblower can choose whether to report through internal or external reporting channels (see Section 7 (1) of the Protection Act). For companies that are the subject of an alleged violation, this can lead to considerable reputational problems. Should the external reporting channel not take action or not take action in a timely manner following a report, the whistleblower is permitted to make the suspected breach of rules known to the public. Such a disclosure can be made, for example, via a report in social media.

III. Penalties

Both the company and the whistleblower can be penalised under the Protection Act. Violations of the Protection Act can be punished with a fine of up to EUR 1 million (see Section 40 (5) in conjunction with Section 30 of the Act on Regulatory Offences). Companies are sanctioned if they violate the requirements of the Protection Act – for example, if an internal reporting channel is not set up or not set up in accordance with legal requirements, or if reports are ignored.

On the other hand, the whistleblower is liable for damages if they have reasonable grounds to believe that their report is incorrect. The liability for damages is certainly likely to play a role in the case of a report to the public.

IV. Conclusion

The Protection Act shows that regardless of the number of employees, it is advisable for a company to operate its own internal reporting channel, in order to take follow- up measures itself. An internal reporting channel is also in line with best practice and therefore is always recommended.

---

Photo: Microgen - stock.adobe.com