After long negotiations, the German Whistleblower Protection Act (HinSchG) was passed by the German legislature on Friday, 12 May 2023. The law is expected to take effect one month after promulgation, i.e., probably in June 2023. It is intended to make the European Whistleblower Directive of 23 October 2019 (Directive (EU) 2019/1937) into national law. To date, there have been no or only a few specific legal requirements in Germany for dealing with whistleblower reports in companies. This is going to change in the future.

The requirements of the law can be summarized as follows:

• The law applies to the reporting of legal violations committed in the workplace or in another institution with which the whistleblower is in contact due to his or her professional activities.
• It requires companies with 50+ employees in Germany to install and operate secure internal reporting systems.
• In group structures, it may be considered to set up a group-wide central reporting office, as this is possible according to the HinSchG. Whistleblowers must be given the opportunity to submit reports verbally, in writing, or, if they wish, in person.
• Upon receipt of a message, certain deadlines arise for the internal reporting office. Receipt must be confirmed to the whistleblower within seven days, and the whistleblower must be informed within three months of the measures taken (e.g. initiation of internal investigations or forwarding of the report to the responsible authorities).
• The HinSchG does not provide an obligation to set up anonymous reporting channels. According to the law, reports received anonymously should nevertheless be dealt with as well.
• In companies with a works council, the works council has co-determination rights on the design and organization of the reporting system, so employers should consider coordinating with the works council on the conclusion of a works agreement.
• To protect whistleblowers, the law provides for a reversal of the burden of proof if they experience disadvantages following a report or disclosure in connection with their professional activities. If whistleblowers claim they have suffered disadvantageous measures, the employer must prove that a measure was not taken in response to a report but for other reasons.
• In case of a disadvantageous measure against a whistleblower, claims for damages may arise. In addition, fines of up to EUR 50,000 are possible for non-compliance with the law.

For larger companies with 250 or more employees in Germany and for financial institutions, irrespective of the number of employees, the obligations under the law will apply immediately after the law comes into force. Companies with 50 to 249 employees have until December 17, 2023, to implement the new requirements.

In view of the short implementation deadlines, companies should promptly check whether existing reporting channels meet the requirements of the HinSchG or whether a new system needs to be introduced.