The new German Whistleblower Protection Act (the “Act”)1 implementing EU Directive 2019/19372 (“Whistleblower Directive”), that the Bundestag passed on May 11, 2023 after a delay of one-and-a-half-years, entered into force yesterday, on July 2, 2023. The Act shall ensure that whistleblowers, who forward information about certain breaches of legal provisions to a reporting unit, are being protected in a professional environment. In particular, companies are now obliged to set up appropriate reporting channels and to comply with the corresponding procedure.
Whistleblowers are persons, who report secret or protected information of public importance or uncover wrongdoing. The Act obliges certain companies to set up a reporting unit, which enables whistleblowers to disclose information on legal violations they have obtained in a professional context within a protected framework.
Companies with 50 or more employees are required to set up internal reporting units to receive and process reports from whistleblowers concerning breaches of legal provisions. While companies with 250 or more employees will be subject to the obligations of the Act from the date of entry into force, smaller companies with 50 to 249 employees will be granted an implementation period until December 17, 2023, see Section 42 (1) of the Act. Smaller companies with up to 249 employees can also set up a joint reporting office. Regardless of the number of employees, companies in the financial sector are obliged to set up a reporting unit as of the date on which the Act comes into force. Whistleblowers have the right to choose between internal and external reporting units (e.g. the Federal Cartel Office’s reporting office, see Section 22 (1) of the Act). However, companies shall explicitly create incentives (e.g. through effective action against violations) that lead to the prioritization of the internal reporting unit by whistleblowers.
The anonymous internal reporting channel provided for in the previous draft law has been removed. It is now merely specified that the units should also process reports received anonymously.
Information about violations only falls within the scope of the Act if it relates to the employer or another body with which the whistleblower has professional contact. After submitting a whistleblower report to an internal reporting unit, the company must take appropriate follow-up measures (e.g. compliance investigations). The whistleblower must be informed of such measures within three months.
Although companies obliged under Section 12 of the Act must set up their own internal reporting unit, Section 14 of the Act allows them to commission a “third party” to do so. Accordingly, it is conceivable that within a group of companies, a group company can set up the reporting unit for several independent companies of the group. However, the responsibility to remedy and follow up the violation must remain with the respective obligated company. However, a certain degree of legal uncertainty regarding the group solution is caused not only by implementation issues, but also by statements by the EU Commission, which rejects the central group solution.
The Act prohibits any reprisal or retaliation directed against whistleblowers. If the whistleblower suffers any adverse action in connection with his or her professional activities, it is presumed to be reprisal.
Violations of key provisions of the Act are also considered administrative offenses that are subject to fines, see Section 40 of the Act. For example, companies that do not set up an internal reporting unit, hinder reports or take reprisals against whistleblowers may be fined. The upper limit for fines is EUR 50,000.
Pursuant to Art. 2 (2) of the Whistleblower Directive, the Member States may, within the framework of national implementing legislation, determine national areas of law that are covered by the Act’s provisions, in addition to European law. The German legislator has made use of this option. Section 2 of the Act conclusively lists the information on violations of which the reporting is protected. In particular, this explicitly includes, in addition to violations that are already subject to criminal penalties or fines, breaches of German and European competition law and the provisions of the European Digital Markets Act.
Concerning merger control provisions, the obligation to suspend the implementation of a concentration is already covered by the Act due to the explicit reference to competition law infringements. By contrast, concerning the likewise possible prohibition of the obligation to suspend the implementation of a concentration under investment control law3, whistleblowers are only protected in the case of reporting intentional, i.e. punishable4, violations.
German and European competition law already provides for reporting possibilities of antitrust violations, in particular within the framework of the leniency programs of the German and European competition authorities. Due to their cooperation, leniency applicants offer the competition authorities an important advantage with regard to the initiation of investigations and the clarification of facts in the case of (suspected) competition law breaches. With regard to these programs, which are considered a central element for effective cartel prosecution, the protection of leniency applicants is widely discussed. Most recently, for example, the EU Commission published new leniency guidelines in the form of an FAQ list5, which particularly address the possibility of anonymous exchanges on potential leniency applications without disclosing details that make the cartel identifiable.
Whereas leniency applications have tended to significantly decline in recent years, the European whistleblower tool, which was already introduced in 2017 and is an external reporting unit at European level, registered around 100 reports per year on practices in violation of competition law.6
Companies should thoroughly deal with the requirements of the Act. The possibility of internal investigation concerning possible violations by internal reporting units clearly emphasizes the importance of comprehensive compliance measures. Since there are legal uncertainties regarding the establishment and operation of reporting units, the process should always be accompanied by experts.
This publication is intended to highlight issues. It is not intended to be comprehensive nor to provide legal advice. Any liability which might arise from the reliance on the information is excluded.
Connect with us and stay informed. 
