Whistleblowing is a contentious topic at the moment: The European Union has issued the “Directive on the protection of persons who report breaches of Union law” (“Directive”) that entered into force on December 16, 2019. On top of that, the European Court of Human Rights (“ECHR”) has recently taken a position on the issue in its decision of February 16, 2021 (Gawlik), which raised some discussion in legal circles. Nonetheless, there remains uncertainty on how whistleblower protection should look in Europe and in Germany. This is essentially because German lawmakers did not yet transpose the Directive in German Law: The draft on the Whistleblower Protection Law was eagerly awaited, but rejected due to considerable political disagreements. For companies, the main questions are: what should they pay particular attention to and what measures should they take. This article will first outline the current situation in Germany, followed by an analysis of the current draft on the whistleblower Protection Law and its status quo and finally examine the resulting changes from the European Union Directive in more detail.
What are Europe and Germany up to at the moment?
Whistleblowers may risk losing their job by disclosing misconduct and/or breaches of the law. This may appear as an honorable and selfless act in the public interest. In Germany, however, individuals coming forward as whistleblowers do sometimes feel they are not treated in such a way. Quite the opposite: for whistleblowers, dismissal and other sanctions include “blacklisting,” being condemned by colleagues, bullying, and being passed over for promotions are real threats/ can be a problem. Why? Because Germany, like many other European Union member states, has not yet implemented an effective legal mechanism to protect whistleblowers from such sanctions. Instead, even rulings from the Federal Labor Court, in some cases, declared such terminations to be lawful. In a balancing of interests, a mere internal disclosure to the employer, who may or may not take the necessary measures, was then given priority over the involvement of the competent external authorities. In doing so, the courts in some cases classify the employee’s interest in external whistleblowing as secondary to the employer’s interest in confidentiality. Even the European Court of Human Rights, generally friendly to whistleblowers, applies a six-point test to determine if they deserve protection and stated that whistleblowers must first seek an internal remedy for the wrongdoing, as well as investigate their suspicions thoroughly.
The Whistleblower Directive in a nutshell
In essence, the content of the Directive can be summarized in three key regulations:
- The whistleblower must first either use the internal reporting channels within the company or contact the responsible authority externally. Public disclosure through media or press is the last resort.
- Companies with 50 or more employees are obliged to set up internal reporting channels and to ensure certain procedures, such as reporting in written, oral or personal form. These reporting channels must be confidential, as well as transparent.
- The most important regulation is the protection of the whistleblower against retaliation and sanctions or the threat of such. Additionally, EU member states have to provide access to support measures, (e.g. advice and effective assistance from competent authorities) and measures to protect against retaliation and sanctions (e.g. protection against liability for the procurement of information).
German parliament is required to transpose these regulations into national law by December 17, 2021. Although the Directive is a step in the right direction, it is rather fragmentary, as it only applies to violations of European Union law (e.g. financial services or protection of privacy and personal data). As a consequence, the Directive does not cover the disclosure of violations of national law (e.g. violations of the German Criminal Code or sexual harassment in the workplace).
Notwithstanding this, the national lawmakers can generally decide whether to implement the Directive extensively and thereby cover violations of national (German) law or not. An extensive implementation is certainly required for effective protection of whistleblowers. For one, it is necessary in order for Germany to stay competitive internationally. Many European countries, like France or the United Kingdom, already have elaborate whistleblower protection, while Germany is trailing behind. Thus, implementing the Directive should be taken as an impulse to create an effective framework. Additionally, for non-lawyers, the difference between a violation of EU law and national law is often difficult to identify – if not to say impossible. The purpose of the Directive, to make it easier to report wrongdoings, should not be reversed by discouraging a whistleblower with an overly complicated scope of application.
German Whistleblower Protection Law – a dead end?
An extensive implementation was also favored in the draft of the Whistleblower Protection Law, recently published in Germany. Firstly, it expanded the scope of whistleblower protection to reports on violations of national (German) regulations. It also included a reversal of the burden of proof in favor of the whistleblower. This means it would no longer be up to the whistleblower to prove that a disadvantageous action has been taken as a result of his/her report, but up to the employer to prove that the action was not related to the employee’s report. Nevertheless, this draft has been rejected and the legislative process has come to a halt for the time being. This is due to the considerable political disagreement on such an extensive implementation. Some feared that these regulations would restrict the economy too much and cause considerable burdens and unbearable costs for many companies. Since the political debate is still ongoing, it is unclear how the Directive will be implemented.
Now: How to deal with whistleblower claims?
Even if the implementation of the Directive is delayed by political disputes, it should be noted that German courts can already take the Directive into account because of the principle of effectiveness (effet utile) under European law (Art. 4 (3) Treaty on the European Union). This rule obliges the member states to fulfil the law of the European Union as best as possible. Accordingly, the Directive can be given effect by the courts by interpreting the applicable German law in light of the Directive even before it has been transposed into national law. Thus, many companies will ask themselves how to deal with whistleblowers in the meantime and wonder what to do with the new European whistleblower framework. Some businesses with ties to the U.S. or other European countries often already have whistleblower systems in place due to whistleblower legislation in those countries. Since those might not necessarily be identical with the new Directive, additional action is required. The following checklist can help identify where companies do stand:
- Implementing the defined internal whistleblower system and reporting channels is a must: Those channels must be easily accessible and completely confidential. In order establish a well-functioning system, sufficient resources, both in terms of telecommunications and IT, as well as in terms of personnel, are necessary. The best way to achieve this is through in-house trainings for managers who will deal with or typically come in contact with whistleblower reports (supervisors, HR).
- It is also crucial to have a clearly structured and comprehensive process in place on how to deal with a report and what follow-up measures should be taken once a report has been made. In doing so a preferable option is to set up an IT-based whistleblowing system. This is mainly done via external providers and holds many benefits. The digital system offers efficient management and documentation, as well as completely anonymous reporting and thus provides a cost and time-effective alternative.
- Once the internal system has been established, it is important to communicate within the company that internal reporting channels exist, how they can be accessed and how they work. A well-working and easily accessible internal system can also reveal many benefits for companies: Staff will more likely report through easily accessible internal channels, rather than involving external authorities. This way, companies can avoid external inquiries and conduct the investigation internally.
- Additionally, follow-up measures and deadlines are important: Companies need to confirm receipt of a whistleblower report within one week and must provide feedback on the report within three to six months. Should companies remain inactive or refuse to carry out follow-up measures, the whistleblower would be free to make the disclosure public.
- Comprehensive documentation is needed: It is crucial for companies to document the reporting procedure thoroughly to prove that any termination or missed promotion or other sanction is not connected to the whistleblower report and therefore cannot be labeled as retaliation.
Lessons learned – The way forward
While the issue of an extensive implementation is unresolved, companies with operations in the European Union and Germany should nevertheless prepare themselves for an extensive implementation into the national laws of EU member states. We recommend using the time until December 17, 2021, to work on the various protective measures. Even companies with existing whistleblowing systems in place should review their systems and prepare for the new European whistleblowing landscape. Especially with an effective internal reporting system, companies can comply with the Directive and avoid external investigations at the same time.