For some time, the European Union has been planning better protection for whistleblowers to improve compliance in companies. Now the clock is ticking. The EU Parliament passed the EU Whistleblower Directive with an overwhelming majority of votes, with 591 votes in favor and just 29 against, 33 abstentions were registered last Tuesday (16 April 2019). Thus, the two-year countdown has started for Member States to convert the Directive into national law.
What is it all about?
In the legal sense, whistleblowing is the reporting of illegal, dangerous or unethical actions through insiders. In labor law, the focus is on reporting misconduct through employees either internally to superiors, management, HR department, designated trusted third parties (ombudsmen/women) or a specially established hotline. As an alternative, the report can also be made externally to relevant authorities and/or the public (media). A report can be anonymous, confidential or in an open manner by revealing names.
The European Union considers whistleblowers as an important element in enforcing comprehensive compliance in companies and assumes that negative aspects such as spying or reporting for unfair, particularly selfish reasons, can be neglected. Accordingly, the EU Directive grants whistleblowers special protection that goes far beyond previous standards.
What is the status quo in Germany?
The focus of the previous whistleblower law is on protection against dismissal. After reporting it has often been the case that whistleblowers themselves have come into their employer‘s focus. However, there have also been cases in which (rightly or wrongly) accused employees were dismissed and resisted against it.
In the absence of special legislation, the German Federal Labor Court demanded that an internal whistleblower should primarily turn to the competent points within the company and prove that he or she acted in good faith in the existence of a criminal offence and, primarily, with the intention of detection.
Despite of a few special laws, particularly in the financial services sector (Securities Trading Act, Money Laundering Act, Financial Services Act), and special laws initiated under European law such as the General Equal Treatment Act, the GDPR and the new Trade Secrets Act there have been no special provisions on whistleblowing. In particular, there has been no general obligation so far to set up a reporting system (apart from the financial sector).
Due to the high personal risk for whistleblowers according to the jurisdiction to get into focus of labor law measures themselves, whistleblowing has not been a central labor law issue in Germany so far.
What is laid down in the Directive?
The situation will now change with both the new Directive as well as the national legal regulations that are to be expected.
In particular, the future obligation to set up an internal whistleblower channel for companies of 50 employees or more or for companies that generate sales revenues/total assets of more than EUR 10 million is worth mentioning. The Directive requires e.g.:
- Reporting options: in writing, by telephone, electronically or in person
- Confidentiality (not: anonymity) must be guaranteed
- Appointment of a responsible person in the company
- Duty to inform employees about the whistleblowing system
- Whistleblowing must also be accessible to customers/suppliers/freelancers.
- Obligation to inform the complainant of the status of the case within three months at the latest
- Obligation to comply with operational codetermination
In addition, the Directive arranges an obligation on Member States to establish external whistleblowing authorities. Although existing authorities (e.g. public prosecutors) can also be considered in principle for this purpose, the Whistleblowing Directive also covers the field below criminal liability, thus a creation of further responsible authorities is to be expected. In the Directive, only areas subject to the EU’s legislative power could be defined as notifiable. However, it expressly provides that the national legislator may extend reporting obligations and thus the protection of whistleblowers to other areas of law which are subject only to national legislation.
The fact that on the part of the complainant (whistleblower) good faith is sufficient, is particularly important in the provision of the Directive, whereas self-interested motives are not relevant. Therefore, an examination of conscience as previously according to the rulings of the German Federal Labor Court, no longer takes place; rather it is sufficient that the whistleblower can demonstrate he or she assumed in good faith that an act of misconduct on the part of the company had taken place.
In return, the complainant enjoys comprehensive protection against reprisals; this applies to all areas of labor law, not just dismissals. A whistleblower who proves that a complaint has been filed and a concrete disadvantage exists, e.g. when being disregarded for a promotion or not having received a bonus or having received a lower bonus than his or her work colleagues, has already made credible the causality for a disadvantage by doing so. Whistleblowing, thereby, does not have to be neither the only nor the dominant reason for discrimination. On the contrary, in such cases the employer must prove that whistleblowing did not play a role in the decision (e.g. bonus allocation, decision on promotions).
The fact that whistleblowers can also generate advantages for themselves, e. g. receiving special protection against dismissal, through making a report in good faith, is considered problematic. However, the EU puts up with this problem, as static surveys have shown that abuse is very rare.
Graduated reporting system
Controversial discussions on the Directive whether internal reporting should be of priority have started at European level. Finally, it was agreed on a graduated system. According to this, a whistleblower, in general, must primarily report to internal responsible bodies, i.e. in particular to the reporting office to be set up.
The whistleblower can only turn directly to an external reporting office when there is a threat to the investigation, a valid concern of retaliation or the disclosure of the whistleblower‘s identity.
In this context, it should be emphasized that in small companies (e.g. companies with fewer than 50 employees in which an obligation to create an internal reporting system does not exist) an external report can be made immediately without the aforementioned requirements having to be met. Consequently, many smaller companies that are not obliged to create an internal reporting system might consider creating such a system anyway. Otherwise, there could be a risk that a report of (alleged) misconduct becomes public immediately.
Direct reporting by the whistleblower to the public, in particular the media, can only be considered if there is a direct or obvious threat to the public interest.
Whistleblowing and data protection – how does that go together?
The Directive refers the issue of data protection to the national legislator. Naturally, personal data play an important role in the whistleblowing process, both on the part of the whistleblower and on the part of the accused person. Therefore, the data of the persons concerned must be handled with appropriate sensitivity in the reporting procedure. In any case, it should be noted that after the national Whistleblowing Act has come into force, a legal basis pursuant to paragraph 6 section 1 lit. f DSGVO for data collection exists and does not have to be obtained from a balancing of interests as it is currently the case.
In practice, it is most likely that works council agreements might play an important role in many companies when it comes to the design of a reporting system, and consequently also the safeguarding of the data protection interests of those affected.
New Trade Secrets Act
Whistleblowing was also an important issue in the context of the new Trade Secrets Act. The delay in converting the EU Trade Secrets Directive into German law was mainly due to last-minute changes made to protect whistleblowers. After whistleblowing was originally a justification, the Trade Secrets Act now contains an exclusion of facts, i.e. a whistleblower who discloses trade secrets within the scope of his or her report does not even violate the Trade Secrets Act.
Work on a German whistleblowing law will now begin. Based on the experience of the Trade Secrets Act and the EU legislative procedure on the Whistleblower Directive, it can be expected that whistleblowing will cover far more areas of law than the EU Directive provides for.
Employers are now requested to adapt existing whistleblowing systems to the Directive and the future national law or to create such systems for the first time. This will make whistleblowing far more important in Germany than it has been in the past and will pose new challenges to employers both in creating and maintaining such systems as well as in the practical implementation (including the conduct of internal investigations).