Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

The status of whistleblowers is regulated in Spain by the Law 2/2023 of February 20th on the protection of persons who report regulatory infringements and the fight against corruption (the “Law”). This law implements Directive 2019/1937 (the Directive) and comply with European standards and came into force in March 13th, 2023 with the following implementation period:

• For companies with more than 250 employees by June 21st, 2023.
• For companies with employees between 50 – 249 employees by December 1st, 2023.

Apart from the above, there are no other legal and regulatory obligations on employers for whistleblowing (except in certain sectors).

In addition, there are several important Spanish regulations that have had an impact on whistleblowing are:

• Section 24 of Law 3/2018, on Data Protection and the guarantee of Digital Rights authorises the creation of information systems for internal complaints regarding actions that could be unlawful and regulates some requirements that need to be met by these channels.
• Section 31 bis of the Criminal Code states that legal entities can be exempt from liability for crimes committed by its legal representatives or persons authorised to take decisions in the name of the company (among others) if the legal entity has implemented, before the criminal offence took place, organisational and management models that include appropriate surveillance and control measures to prevent offences or reduce the risk of them occurring.
• Section 48.1 of Law 3/2007 on effective equality between women and men states that companies must establish workplace conditions that prevent sexual harassment. Consequently, they are required to establish procedures destined to prevent this conduct and study complaints made by victims.
• Sections  26 bis and 63 of Law 10/2010 on the prevention of money laundering and terrorist financing establishes that entities or individuals to whom this law applies[1] must implement internal procedures that allow employees, directors, and other agents to communicate (even anonymously) relevant information regarding money laundering and terrorist financing in their company.
• Law 10/2022 of 6 September on the comprehensive guarantee of sexual freedom which modifies sections 173 and 184 of the Criminal Code.

Additionally, entities and individuals who fall under the law’s scope must protect employees, directors or agents who report information from retaliatory, discriminatory, or unfair measures, thus establishing a soft-law mechanism.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

According to section 10 of the Law, in the private sector, natural and legal persons with 50 or more workers must establish internal information systems.

Moreover, irrespective of the number of employees, legal entities falling within the scope of European Union law regarding financial services, products and financial markets, the prevention of money laundering or terrorist financing, transport safety and environmental protection, referred to in parts I.B and II of the Annex to the Directive, will be governed by their specific regulation. In these cases, the Law will only apply to matters not covered by said specific regulations.

Political parties, trade unions, employers' organisations and foundations created by them, insofar as they receive or manage public funds, may also implement whistleblowing procedures.

Private-sector entities that do not need to establish internal information systems but decide to do so anyway must also respect the content of the Law.

According to section 13 of the Law, all public-sector entities must establish internal reporting channels.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

According to section 11 of the Law, Group companies as defined in section 42 of the Spanish Code of Commerce (basically, when a company has or may have, directly or indirectly, control of another company or companies), the parent company may adopt a general policy for an internal reporting system and whistleblower protection and should also ensure its application in all entities of the Group, without prejudice to the autonomy and independence of each of the companies to establish its own corporate governance system or to introduce modifications or adaptations as may be necessary to comply with applicable regulations in each case.

The Responsible for the system and the internal information system itself could be unique for the Group companies or there could be one for each of the companies in the group, under the terms established above.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

Yes. Section 63.1.(g) establishes that “Failure to comply with the obligation to have an internal information system in the terms required by this law” will be considered a very serious infringement.

According to section 65, for a very serious infraction, the sanction is a fine between 600,001 EUR and 1,000,000 EUR.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

Yes. Section 5 of the Law states that the management body or governing body of each entity or body that must establish “internal information systems” will be responsible for their implementation, after consultation with the employees´ legal representatives.

The consultation pertains to the information system, not the internal policy regarding internal systems. In the absence of employees´ legal representatives, it will suffice to comply with the disclosure of the system to the staff and other relevant parties.

Moreover, collective-bargaining agreements may also establish certain obligations in this regard.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

Section 25 of the Law states that the company should provide appropriate information, in a clear and accessible way, on the use of internal reporting channels, as well as on the essential principles of the procedure to be followed. If the company has a website, said information should be reflected on the homepage, in a separate and easily identifiable section.

In addition, according to section 9 of the Law employers are obliged to give training to all personnel who are not responsible for data processing to ensure the confidentiality of the information they receive.

Moreover, competent public authorities are also subject to publicity measures regarding whistleblowing procedures, including: conditions to be eligible for the protection reflected in the Law; contact information regarding external channels; management procedures; confidentiality; remedies and procedures for protection against retaliation; and the availability of confidential advice.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Yes, the management of internal reporting channels can be outsourced as established in section 6 of the Law. However, a third party managing the reporting channel must provide adequate guarantees of respect for independence, confidentiality, data protection and secrecy. This third party would be considered a “data processor”, whereas the person or persons appointed by the company as “responsible for the system” will still be responsible for the reporting channel, even when it is outsourced.

In this connection, section 6.1 of the Law restricts the involvement of the external third party to the receipt of information, meaning the management of the mailbox where information is received. Therefore, the processing of information, including the investigation of facts and any other procedures or decisions, must always be undertaken internally.

Management of an internal information system by a third party should not undermine the guarantees and requirements established for this system in the Law.

The existence of joint controllers for the processing of personal data requires the prior signing of the agreement regulated in Article 26 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and in Organic Law 3/2018, of December 5, on the Protection of Personal Data and the guarantee of digital rights.

The management of the internal information system by a third party must not compromise the guarantees and requirements established for such a system by the Law or assign responsibility for it to a person other than the system manager.

The external third party managing the system shall be considered a data processor for the purposes of legislation on the protection of personal data. The processing shall be governed by the act or contract referred to in Article 28.3 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

Section 24 of Law 3/2018 on Data Protection and the guarantee of Digital Rights establishes certain obligations, for both private and public entities, to protect the data collected. For instance, access to data will be limited to individuals who work in internal control and compliance, as well as those who will eventually be designated to manage the data.

In exceptional circumstances, the information can be transmitted to third parties (eg, HR department) for disciplinary reasons or judicial proceedings. Moreover, there will be a requirement to adopt measures to conceal the identity and guarantee the confidentiality of those who have participated in the procedure, especially the whistleblower.

The data of the reporting employee, employees and third parties must be retained in the whistleblowing system only for the time necessary to decide whether to initiate an investigation into the reported facts.

In any case, three months after the data has been introduced into the information system, it must be deleted, unless the purpose of its retention is to provide evidence of the functioning of the model for the prevention of offences by the legal entity.

Once the three-month period has elapsed, the data may continue to be processed by the body responsible for investigating the reported facts, but may not be kept in the internal complaints information system itself.

As per the Law, the preservation of the identity of the whistleblower is one of the essential premises to guarantee the effectiveness of the protection sought by the Law.

It is stipulated that the whistleblower's identity will never be subject to the right of access to personal data and the possibility to communicate said identity is limited only to the judicial authority, the Public Prosecutor's Office or the competent administrative authority, requiring that in all cases third parties are prevented from gaining access to it.

Moreover, entities that must have an internal channel, external third parties that may manage it and the Independent Data Protection Authority are required to have a data protection officer.

Section 32 of the Law also establishes that access to personal data contained in internal information systems will be limited, within the scope of their powers and functions, to certain persons (those responsible for the system and HR, among others).

It is also relevant to point out that all parties that must have internal information systems, either private or public, will keep a register of the communications received and the internal investigations they have given rise to while guaranteeing, in all cases, the confidentiality requirements provided for in the Law.

This register will not be public and the contents of the said register may only be accessed in whole or in part at the request of the competent judicial authority, through an order and within the framework of a judicial proceeding and under the guardianship of the latter.

Personal data relating to the communications received and the internal investigations referred to in the previous paragraph will only be kept for a necessary and proportionate period to comply with the Law. In no case may the data be kept for longer than 10 years.

Moreover, if after three months of receipt of the communication and no investigation has been initiated, the communication will be deleted unless it is retained as evidence of the operation of the system.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

Some requirements must be met in the implementation of whistleblowing procedures: easy-to-follow guidelines, confidentiality, and good practice for monitoring, investigation and whistleblower protection.

These precautions are bolstered by sections 18 and 20 of the Constitution. These sections consolidate the rights to privacy, information and freedom of speech that influence Law 3/2018 on Data Protection and the guarantee of Digital Rights, and the Law.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

Section 2 of the Law establishes that “this law protects the natural persons who report, through any of the procedures provided for therein”:

1. Any action or omission in breach of European Union law as defined in the Annex to the Directive, regardless of the categorisation they receive under national law, and provided that they affect the financial interests of the Union as referred to in section 325 TFEU or have an impact on the internal market as referred to in section 26 (2) of the TFEU.
2. Any action or omission that may constitute a serious or very serious criminal or administrative offence or any violation of the rest of the legal system, provided that it directly affects or undermines the public interest and does not have a specific regulation. In any case, the public interest is deemed affected when the action or omission involves economic loss for the Treasury.

Section 2 also refers to particular cases where the protection of the Law transposing the Directive will apply (for example, in reports regarding infractions of occupational hazards regulations, even if there is a specific regulation) or not (classified information, among others).

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

Yes, for example in the finance sector (anti-money laundering) and antitrust, as mentioned in question 1.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

A natural person, working in the private or public sector, who acquires information on breaches (as defined in question 10) in a work-related context and reports them.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

The definition given by the Law (section 3) is very similar to the one in section 4 of the Directive, namely:

• civil servants and workers;
• self-employed;
• shareholders and persons belonging to the administrative, management or supervisory body of an undertaking, including non-executive members; and
• any persons working under the supervision and direction of contractors, subcontractors and suppliers.

The Law will also apply to persons when they report or publicly disclose information on breaches obtained in a work-based relationship that has since ended, volunteers, trainees (regardless of whether they are paid or not) and persons whose employment relationship is yet to begin in cases where information on breaches has been obtained during the recruitment process or other pre-contractual negotiations.

In addition, the protection measures shall also apply, where appropriate: (i) To the legal representatives of the workers when they exercise their advisory and support functions for the whistleblower; (ii) To individuals who, within the organization where the whistleblower provides their services, assist them in the process. (iii) To individuals who are associated with the whistleblower and may face retaliation, such as co-workers or family members of the whistleblower..

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

This is described in questions 12 and 13.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

Under the Law, anonymous alerts are authorised. Precisely, section 7.3 establishes that “internal channels should allow the submission and processing of anonymous reports”. Moreover, as per external channels, section 17.1 also reflects that “communication can be carried out anonymously”.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

The Law does not establish any obligation in this regard, so it does not seem necessary that the whistleblower must be a direct witness of the violation. However, reporting persons should have reasonable grounds to believe that the matters reported are true, a situation that is more likely to happen when the reporting person is a direct witness.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

The Law establishes two ways of reporting: internal and external reporting.

Regarding internal report channels, communications should be written or verbal or both. Section 7.2 regulates different ways of reporting the information (post, email or any other accepted electronic means, phone or voice message, in person, among others).

Section 9 of the Law regulates the procedure to manage information. First, the procedure may be approved by those responsible for the system and in charge of its diligent handling. Then, the agreed procedure will establish the necessary provisions for the internal information system to comply with the Law enacting the Directive. In particular, it will cover the following at a minimum:

• an identifiable internal information system;
• receipt of acknowledgement must be submitted within seven days to the reporting person (if identified), unless it compromises confidentiality;
• potential contact with the whistleblower if it is deemed necessary to obtain further information.
• additionally, the potential offender is entitled to be informed about the accusations against him or her. Such communication will take place at the time and in a manner as is deemed appropriate to ensure a proper investigation;
• the investigated individual has a right to the presumption of innocence, a right to be heard and for their honour to be respected;
• investigations should last no longer than three months from the date of receipt of the information. This can be extended by three additional months if the matter is particularly complex;
• section 9.2 also indicates that clear and easily accessible information on external channels or European entities should be included; and
• confidentiality and personal data must be respected. 

Regarding external report channels, an independent authority for the protection of whistleblowers will be established (until now, the government has not approved the legal status and governance of this independent authority). Whistleblowers are allowed to choose that path directly or after having used internal information systems. The type (written, verbal) and means to send the report are the same as the ones for internal systems.

Once the communication has been made, it will be registered in the communications management system and an identification code will be assigned to it. The communications management system will be contained in a secure database with access restricted to the staff of the authority for the protection of whistleblowers.

A receipt of acknowledgement should be given within five business days of receiving the information (unless the reporting person is anonymous or has waived receipt of communications relating to the investigation).  

When the information is registered, it is subject to a preliminary analysis (maximum of 10 business days) by the state-level or regional-level independent authority – to see whether the report falls into the scope of the law enacting the Directive or could be considered a criminal offence. This will result in:

• admission – to be communicated to the whistleblower, if any, within five business days; or
• rejection – when the facts reported lack plausibility or do not fall under the scope of the Directive or, even falling under the said scope, do not affect the public interest. The rejection should be communicated to the reporter, if any, within five business days;
• it can be admitted to the entity or body considered competent to process it or it affects the interests of the Treasury. When the facts may indicate a criminal offence, it will be referred to the Public Prosecutor's Office.

If it is admitted, investigations ensue. The investigated individual will be notified, and a succinct explanation of why he or she is being investigated will be provided.  

These inquiries will conclude in a report by the Independent Authority for the Protection of the Whistleblower or corresponding local Authority, which will close the case, begin a disciplinary procedure or transfer the case to another authority.

In any case, investigations should last no longer than three months from the date of receipt of the information.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

The Law clearly states that internal reporting channels are preferred (section 4.1 of the Law), and that external reporting channels are complementary. However, the whistleblower is entitled to choose freely between both options.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

The Law does not establish specific situations in which employers need to inform external authorities about the whistleblowing. However, if the reported act or omission could be considered a criminal offence, the employer should inform the public prosecutor. If the reported act or omission could be considered an administrative infraction, the competent authority should also be informed.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

The Law does not explicitly pardon those who have reported information that has not been confirmed or that simply does not constitute an infraction. However, the Law does seem to ensure that those who reported information in good faith will not be punished.

On the contrary, those who knowingly reveal false information might be sanctioned, according to section 63 of the Law.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

Sanctionable conduct is regulated in section 63 of the Law. Obstruction of the whistleblower may be punished, depending on the circumstances, as a minor, serious or very serious infraction.

According to section 65 of the Law, for a minor infraction, the sanction will be a fine of up to 10,000 EUR if the perpetrator is a natural person. If the perpetrator is a legal entity, this increases to 100,000 EUR.

For serious infractions, the sanction will be a fine ranging from 10,001 to 30,000 EUR if the perpetrator is a natural person. If the perpetrator is a legal entity, this increases to between 100,001 and 600,000 EUR.

For very serious infractions, the sanction is a fine ranging from 30,001 to 300,000 euros for a natural person. If the perpetrator is a legal entity, this increases to between 600,001 to 1,000,000 EUR. Very serious infractions might also result in other sanctions at the discretion of the Independent Authority for the Protection of Whistleblowers.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

If the whistleblower believes that he or she has been retaliated against, he or she should inform the corresponding Independent Authority for Whistleblower Protection – or the equivalent body in the corresponding autonomous community. This is the Authority responsible for the adoption of protection measures and for imposing sanctions under Title VIII of the Law when infractions fall under the public sector scope and in the private sector when the reported infringement affects more than one autonomous community.

Moreover, the whistleblower, if appropriate, can also inform the company (internal disciplinary powers) or even file a claim against its employer before the Labour Courts (because dismissal or other measures implemented by the company as retaliation for having reported unlawful practices will be declared null and void). As stated in section 38 of the Law, in employment proceedings before a court, once the whistleblower has reasonably demonstrated that he or she has communicated or made a public disclosure under the Law transposing the Directive and that he or she has suffered prejudice, it will be presumed that the prejudice occurred in retaliation for that disclosure. In such cases, the person who has taken the detrimental action will need to prove that such action was based on duly justified reasons not linked to the communication or public disclosure.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

The scope of protection is regulated in sections 35 and 36 of the Law. Specifically, to be eligible for protection, an individual must report an action or omission that falls under section 2 of the Law (content already mentioned), provided:

• they have reasonable grounds to believe the information is true, even if they do not provide conclusive evidence, and that said information falls within the scope of application of the Law; and
• they have obtained that information according to the conditions contained in the Law.

In certain cases, protection must be denied when, for example, the information provided is not relevant, is mere rumour or is already available to the public.

As per the protection granted by the Law, any act constituting retaliation or threat or attempt of retaliation against whistleblowers is forbidden. The acts, threats or attempts considered retaliatory will be declared null and void.

The Law defines retaliation as any acts or omissions prohibited by law, or that directly or indirectly result in disadvantageous treatment compared to another person in the employment or professional context, solely because of their status as whistleblowers, or because they have made a public disclosure, and provided that such acts or omissions occur during the investigation procedure or two years after the completion of the investigation procedure or from the date on which the public disclosure took place. An exception will be made where such an act or omission can be justified by a legitimate aim and the means of achieving that aim are necessary and appropriate.

      By way of example, the following events can be considered retaliation:

• suspension, lay-off, dismissal or equivalent measures (eg, early termination of a temporary employment contract once the probationary period has expired), or early termination or cancellation of contracts for goods or services, the imposition of disciplinary measures, a demotion or withholding of promotion and any other substantial modification of working conditions unless these measures were carried out within the regular exercise of management power;
• damage, including damage to reputation, financial loss, coercion, intimidation, harassment or ostracism;
• a negative performance assessment or employment reference;
• blacklisting or dissemination of information in a particular sectoral area that hinders or prevents access to employment or the contracting of works or services; and
• cancellation of a licence or permit;
• denial/refusal of training;
• discrimination or unfair treatment;

Apart from whistleblowers, the protection will also extend to:

• legal representatives when they are advising and supporting the whistleblower;
• natural persons who, within the organisation in which the whistleblower provides services, assist him or her in the process;
• natural persons who are related to the whistleblower and who may suffer retaliation, such as co-workers or relatives of the whistleblower; and
• legal entities for whom he or she works or with whom he or she has any other type of relationship in an employment context or in which he or she has a significant shareholding.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

Whistleblowers will be granted certain support measures, according to section 37 of the Law. For instance, first, they will be informed and advised for free on procedures and resources put in place to ensure their protection against retaliation. Second, they will benefit from assistance regarding protection against retaliation. Third, they will enjoy monetary and psychological assistance in exceptional cases if the Independent Authority for the Protection of Whistleblowers deems it adequate.

All of them, irrespective of the free legal aid foreseen under Law 1/1996.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

For abusive reporting, whistleblowers may be sanctioned according to sections 63 and 65 of the Law. Moreover, depending on the content of the report, he or she could be committing a criminal offence.

It is also worth saying that, according to section 63 paragraph b, non-compliance with the obligation to collaborate with the investigation is considered a minor infringement.

Finally, in certain cases, non-compliance with the procedure could lead to the investigation coming to an end.