The time has come: The Whistleblower Protection Act (HinSchG) is coming. This means that many SMEs need to take action.
After tough negotiations, the federal and state governments have reached an agreement. In particular, all companies with more than 50 employees will be obliged to set up a reporting channel in future.
We explain the background and offer possible solutions.
Initial situation
People with a close connection to internal processes usually notice grievances in companies much earlier than the management. Employees can have such knowledge, but also third parties such as suppliers or service providers.
The entrepreneurial interest is then usually to clarify and investigate the facts themselves and to take remedial action, as reporting to other third parties or authorities, such as the new federal reporting office, would also be conceivable. In this case, damage – for example a fine or a claim for damages – could hardly be averted.
At the same time, the reports can be used to improve business processes or track violations internally. In any case, advice should be taken seriously. However, some companies refrain from raising awareness because there is little room for this in their day-to-day business.
The legislator is now addressing this problem with the Whistleblower Protection Act. It specifies reporting channels and measures, obliges companies to introduce them and standardizes ways and means that provide many advantages for gaining internal knowledge.
Whistleblower Protection Act
After a tough struggle, the Federal Council also agreed to the compromise reached in the Mediation Committee and paved the way for the German implementation of the Whistleblower Directive (EU) 2019/1937.
The Whistleblower Protection Act is intended to protect people who wish to report all conceivable types of wrongdoing. These can be simple mistakes in business transactions, but also criminal offenses or other violations. Above all, whistleblowers should be given the opportunity to report their findings to the company via an easily accessible, anonymous reporting channel.
In future, the Whistleblower Protection Act will regulate the obligations of companies when dealing with whistleblowers.
Regulations in detail
The Whistleblower Protection Act will take effect one month after the law is promulgated, i.e. probably at the end of June 2023.
For companies with more than 50 employees, the obligation to set up a reporting channel will apply from December 17, 2023. For companies with more than 250 employees, the obligation even applies from one month after the law is promulgated.
The reporting channel must lead to an independent, competent internal or external body. The management itself would therefore not be eligible for this. However, the Data Protection Officer is listed as an appropriate body in the Whistleblower Directive (Recital 56), which could simplify processes. In the opinion of the Data Protection Conference, the latter must in any case carry out a data protection impact assessment when setting up the reporting channel.
A text or verbal (e.g. telephone) report must be made possible. The report is followed by investigations into the reported incident. Of course, the whistleblower must be informed about the procedure and their rights (e.g. data protection) at all times.
The law also stipulates that the receipt of reports must be confirmed within seven days, queries must be possible, follow-up measures must be taken and a final report must be made to the whistleblower within three months. The documentation of the processes must be deleted three years after completion of the procedure.
External, web-based reporting channels that are easy to implement and do not disrupt normal operating processes are therefore particularly practical. A link on the company website would then be able to point to the reporting channel. We are happy to provide you with such a solution from approx. 50 € per month.
Reprisals against the whistleblower are generally prohibited. However, in the event of intentional or grossly negligent disclosure of false facts, the whistleblower is entitled to claim damages.
Violations of the Whistleblower Protection Act, e.g. a reporting channel that has not been set up or unsuitable reporting points, can result in fines of up to €50,000.
Conclusion
The introduction of the Whistleblower Protection Act opens up many opportunities for companies to further develop business processes after violations have been identified at employee level. Of course, this involves a certain amount of effort, but this is likely to be offset by the many useful findings.
