Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

The Protected Disclosures Act 2014 governs the status of whistleblowers in Ireland. The 2014 Act was amended by the Protected Disclosures (Amendment) Act 2022 to ensure that the rules governing whistleblowing comply with the EU Whistleblowing Directive.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

All private-sector employers with over 50 employees must establish formal channels and procedures for their employees to make protected disclosures. There was a derogation from these obligations in place until 17 December 2023 for organisations with between 50 and 249 employees. 

The threshold of 50 employees will not apply to employers who are public bodies or employers who fall within the scope of certain European Union acts, including but not limited to those related to financial services, products, markets, prevention of money-laundering and terrorist financing, transport safety, and protection of the environment. These employers, regardless of size, must comply with the obligations contained in the Act.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

Employers with less than 250 employees may share resources as regards the receipt of reports and any investigation to be carried out as part of the follow-up process. However, this ability to share resources does not remove the obligation of each employer to put in place formal channels and procedures for employees to make protected disclosures. The definition of an employer means that a Group with over 250 employees in total may be able to share resources where each entity within the Group has less than 250 employees. In addition, the ability to share resources is not limited to employers who are connected or part of a Group structure but also applies equally to unrelated employers who fall under the 250-employee threshold.  

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

A person who fails to comply with the requirement to establish, maintain and operate internal reporting channels and procedures commits an offence. A person who commits such an offence is liable:

• on summary conviction, to a class A fine (maximum fine of 5,000 EUR) or imprisonment for a term not exceeding 12 months, or both; or
• on conviction on indictment, to a fine not exceeding 250,000 EUR or to imprisonment for a term not exceeding two years, or both.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

There is no requirement that employee representative bodies are involved in the implementation of internal reporting channels and procedures. However, some employers may wish to engage with employee representative bodies concerning this.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

There are no prescribed publicity measures for the whistleblowing policy within the company. However, as with all company policies, it should be made available to all employees at the commencement of their employment and be available on the company intranet or through human resources.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Internal reporting channels and procedures may be operated internally by a person or department designated for that purpose by an employer or provided externally by a third party authorised by an employer. It will be up to each employer to decide which approach is most suitable for their organisation.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

Under the Protected Disclosures Act 2014, as amended, an employer may restrict the rights of a data subject (eg, to transparency, information and access, rectification and erasure):

• to the extent necessary and proportionate for:
  • safeguarding the important objectives of the general public interest, and
  • protecting the data subject or the rights and freedoms of others, and
     
• to the extent, and as long as, necessary to prevent and address attempts to hinder reporting or to impede, frustrate or slow down follow-up, in particular investigations, or attempts to find out the identity of reporting persons.

A restriction will be considered necessary and, as the case may be, proportionate where the exercise of the right or compliance with the obligation may:

• necessitate the disclosure of information that might identify the reporting person where such disclosure would be contrary to the duty of confidentiality, or
• prejudice the effective follow-up, including any investigation of the relevant wrongdoing concerned.

Where a restriction of a right or obligation is applied, an employer who receives a report must inform the data subject of the restriction, unless to do so would:

• necessitate the disclosure of information that might identify the reporting person where such disclosure would be contrary to the duty of confidentiality,
• prejudice the effective follow-up, including any investigation, of the relevant wrongdoing concerned, or
• prejudice the achievement of any of the important objectives of the general public interest.

An employer who receives a report must also inform the data subject of the possibility of lodging a complaint with the Data Protection Commission or of seeking a judicial remedy concerning such restriction. The employer must also ensure that personal data is stored for no longer than is necessary.

An employer is also required to implement technical and organisational measures to prevent the abuse or unlawful access to or transfer of personal data in respect of which the employer is the controller, including but not limited to:

• the use of secure storage, passwords, encryption and other methods to ensure that personal data can only be accessed by persons authorised by the employer to access that data;
• the use of controls to ensure that personal data is only disclosed to persons authorised by the employer, or are entitled or permitted by law, to receive that data;
• data minimisation, including the use of anonymisation and pseudonymisation, where appropriate.

In addition, personal data which is manifestly not relevant for the handling of a specific report must not be collected or, if accidentally collected, must be deleted without undue delay.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

Having regard to the statutory obligations placed on them, employers should ensure the applicable policy/procedure has some flexibility contained therein to vary the procedure/approach, if circumstances require.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

Any worker may make a protected disclosure where they believe they have information that tends to show one or more relevant wrongdoings, and such information came to their attention in a work-related context.

The following matters are relevant wrongdoings under the 2014 Act:

• that an offence has been, is being or is likely to be committed;
• that a person has failed, is failing or is likely to fail to comply with any legal obligation, other than one arising under the worker’s contract of employment or another contract whereby the worker undertakes to do or perform any work or services personally;
• that a miscarriage of justice has occurred, is occurring or is likely to occur;
• that the health or safety of any individual has been, is being or is likely to be endangered;
• that the environment has been, is being or is likely to be damaged;
• that unlawful or otherwise improper use of funds or resources of a public body, or other public money, has occurred, is occurring or is likely to occur;
• that an act or omission by or on behalf of a public body is oppressive, discriminatory or grossly negligent or constitutes gross mismanagement;
• that a breach has occurred, is occurring or is likely to occur; or
• that information tending to show any matter falling within any of the preceding paragraphs has been, is being or is likely to be concealed or destroyed or an attempt has been, is being or is likely to be made to conceal or destroy such information.

A breach means an act or omission that is unlawful and to which one or more of the following applies:

• it falls within the scope of the European Union acts set out in Schedule 6 to the 2014 Act that concern the following areas:​​​​​
  • public procurement;
  • financial services, products and markets, and prevention of money laundering and terrorist financing;
  • product safety and compliance;
  • transport safety;
  • protection of the environment;
  • radiation protection and nuclear safety;
  • food and feed safety and animal health and welfare;
  • public health;
  • consumer protection; or
  • protection of privacy and personal data, and security of network and information systems;
• it affects the financial interests of the Union; or
• it relates to the internal market, including breaches of European Union competition and state aid rules, as well as breaches relating to the internal market regarding acts that breach the rules of corporate tax or to arrangements designed to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law; or
• it defeats the object or purpose of the rules in the Union acts and areas referred to above.

In addition, the 2014 Act provides that a matter concerning interpersonal grievances exclusively affecting a reporting person is not relevant wrongdoing for the Act. Instead, such grievances should be dealt with through other internal procedures.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

No.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

There is no legal definition of a whistleblower in Irish law. The Protected Disclosures Act 2014, as amended, protects workers, from the taking of action against them, in respect of the making of certain disclosures. Any worker may make a protected disclosure where they believe they have information that tends to show one or more relevant wrongdoings, and such information came to their attention in a work-related context.

The disclosure must be in the manner prescribed in the 2014 Act, depending on whether the disclosure is made to an employer or other responsible person, a prescribed person, a minister, a legal advisor, to the Protected Disclosures Commissioner and in other cases.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

A worker who makes a protected disclosure is entitled to the protections of the Protected Disclosures Act 2014, as amended. What constitutes a worker is very broad. The Protected Disclosures (Amendment) Act 2022 extended the scope of the protected disclosures regime to cover volunteers, unpaid trainees, board members, shareholders, members of administrative, management or supervisory bodies and job applicants (where information on relevant wrongdoing is acquired during the recruitment process or pre-contractual negotiations), in addition to traditional employees.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

To be able to avail of the protections afforded by the Protected Disclosures Act 2014, as amended, any worker may make a protected disclosure where they believe they have information that tends to show one or more relevant offences, and such information came to their attention in a work-related context.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

The Protected Disclosures Act 2014, as amended, provides that there is no obligation to accept and follow up on anonymous reports, but an employer may choose to do so. It also clarifies that a worker who makes a disclosure by way of an anonymous report, and who is subsequently identified and penalised for having made a protected disclosure, is entitled to the protections contained in the 2014 Act.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

To be protected under the Protected Disclosures Act 2014, as amended, a reporting person does not have to be a direct witness of the violation that they are reporting on. The 2014 Act provides that any worker may make a protected disclosure where they believe they have information that tends to show one or more relevant wrongdoings, and such information came to their attention in a work-related context.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

Employers are required to establish and operate internal reporting channels that maintain the confidentiality of the identity of the reporting person. Employers must acknowledge a report, in writing, to the reporting person within 7 days of receipt of the report.

Employers must designate an impartial person competent to follow up on reports. This designated person is tasked with maintaining communication with the reporting person. The designated person is required to diligently follow up on the report. Diligent follow-up includes the provision of feedback within a reasonable period and, in any case, at 3 month intervals. It must include the carrying out of an initial assessment. If, having carried out an initial assessment, the designated person decides that there is no prima facie evidence that a relevant wrongdoing occurred, the procedure can be closed and the reporting person notified, in writing, as soon as practicable, of the decision and the reasons for it.
However, if, having carried out an initial assessment, the designated person decides that there is prima facie evidence that a relevant wrongdoing may have occurred, appropriate action should be taken to address the relevant wrongdoing, having regard to the nature and seriousness of the matter concerned.

Clear and easily accessible information on the procedures applicable to the making of reports must also be provided.

Similar provisions to those in relation to internal reporting channels and procedures also apply to reports to prescribed persons. The different reporting channels and the thresholds to be met in order to qualify for protection for having made a protected disclosure through a relevant channel are set out in the answer to question 22.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

Both the EU Whistleblowing Directive and the Irish implementing legislation makes it clear that ideally wrongdoing would be reported internally in the first instance. The various reporting channels, and accompanying test that have to be met in order to make disclosures through those channels, have been put in place to incentivise workers to report wrongdoing internally first and to only seek assistance through other channels where internal procedures are exhausted or may not be appropriate in certain limited circumstances.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

Section 19 of the Criminal Justice Act 2011 establishes that a person/corporate entity will be guilty of an offence:

• if they have information; and
• they know or believe that information will or might be of material assistance in preventing the commission of a relevant offence or securing the apprehension, prosecution or conviction of any other person for a relevant offence; and
• they fail without a reasonable excuse to disclose that information as soon as it is practicable to do so to An Garda Síochána (the Irish police force).

The “relevant offences” are set out in the schedule to the 2011 Act and are wide-ranging. These are arrestable offences and include: breaches of company law, competition law, banking, investment funds and other financial activities, theft and fraud, bribery and corruption, criminal damage to property and consumer protection. The range of offences covered can be amended by ministerial order.

The obligation to make a notification under section 19 applies to any person, including corporate entities as well as natural persons. If an offence is committed by a corporate entity and it can be proven that this was done with the consent or connivance of any officer (such a director) or was as a result of the officers wilful neglect, that person will also be guilty of an offence and will be prosecuted and penalised as if they had committed the offence themselves.

The maximum penalty for failing to report an offence is an unlimited fine and imprisonment for up to 5 years, or both.

A person is under a mandatory statutory obligation to make a report under the 2011 Act as soon as it is practicable to do so.

Persons/corporate entities will be guilty of an offence under the 2011 Act if they fail to report a relevant offence without ‘reasonable excuse’.

A reasonable excuse is also not defined under the 2011 Act, and would likely be dependent on the circumstances of the case. For example, when a person may themselves be involved or implicated in the offence and reporting might compel them to incriminate themselves, this would be a reasonable excuse. The Courts have held that a reasonable excuse may exist when there is some “physical or practical” difficulty in reporting the crime or if the information has already been disclosed.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

A person making a protected disclosure, as defined by the Protected Disclosures Act 2014, as amended, is protected against penalisation, detriment and criminal and civil liability, other than in respect of a defamation action. However, qualifying protected disclosures attract qualified privilege for the purposes of the Defamation Act 2009.

There is no requirement that the report must be verified or the facts confirmed in order to avail of the protections of the 2014 Act so long as the disclosure is made in the manner set out in the Act, depending on whether the disclosure is to the employer, a prescribed person, a Minister, a legal advisor, the Protected Disclosures Commissioner or in some other way.

However, a reporting person who makes a report containing any information that he or she knows to be false commits an offence. A person who commits such an offence is liable (i) on summary conviction, to a class A fine (a fine not exceeding 5,000 EUR) or to imprisonment for a term not exceeding 12 months, or both, or (ii) on conviction on indictment, to a fine not exceeding 100,000 EUR or to imprisonment for a term not exceeding 2 years, or both.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

It is an offence to hinder or attempt to hinder a worker in making a report, or to penalise or threaten penalisation or cause or permit any other person to penalise or threaten penalisation a reporting person or to bring vexatious proceedings against a reporting person. These offences attract significant penalties. A person who commits one of these offences is liable (i) on summary conviction, to a class A fine (a fine not exceeding 5,000 EUR) or to imprisonment for a term not exceeding 12 months, or both, or (ii) on conviction on indictment, to a fine not exceeding 250,000 EUR or to imprisonment for a term not exceeding 2 years, or both.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

The procedure that a whistleblower must follow in order to receive protection under the Protected Disclosures Act 2014, as amended, will depend on the person to whom he/she reports the relevant wrongdoing. These procedures are set out in section 6, 7, 8, 9 and 10 of the 2014 Act. The various tests that have to be met in order to make disclosures through various channels are put in place to incentivise workers to report wrongdoing internally first and to only seek assistance through other channels where internal procedures are exhausted or may not be appropriate in certain limited circumstances.

A disclosure is made in the manner specified in section 6 where the worker makes it to the his/her employer or to another person where the worker reasonably believes that the relevant wrongdoing relates solely or mainly (i) to the conduct of that other person, or (ii) to something for which that other person has legal responsibility.

A disclosure is made in the manner specified in section 7 where the worker makes it to a prescribed person and reasonably believes that

• that the relevant wrongdoing falls within the remit of that prescribed person, and
• that the information disclosed, and any allegation contained in it, are substantially true.

A disclosure is made in the manner specified in section 8 where the worker makes it to a relevant Minister if (a) the worker is or was employed in a public body, and (b) one or more than one of the following conditions are met:

1. the worker has previously made a report of substantially the same information in the manner specified in section 6, 7 or 8, but no feedback has been provided, or, where feedback has been provided, the worker reasonably believes that there has been no follow-up or that there has been inadequate follow-up;
2. the worker reasonably believes the head of the public body concerned is complicit in the relevant wrongdoing;
3. the worker reasonably believes that the relevant wrongdoing concerned may constitute an imminent or manifest danger to the public interest, such as where there is an emergency situation or a risk of irreversible damage.

A disclosure is made in the manner specified in section 9 if it is made by the worker in the course of obtaining legal advice (including advice relating to the operation of this Act) from a barrister, solicitor, trade union official or official of an excepted body, i.e. a trade union.

A disclosure is made in the manner specified in section 10 if:

• it is made otherwise than in the manner specified in sections 6 to 9,
• the worker reasonably believes that the information disclosed in the report, and any allegation contained in it, are substantially true, and
• the worker:
  • has previously made a disclosure of substantially the same information in the manner specified in section 6, 7 or 8, but no appropriate action was taken or
  • reasonably believes that:
    1. the relevant wrongdoing concerned may constitute an imminent or manifest danger to the public interest, such as where there is an emergency situation or a risk of irreversible damage, or
    2. if he or she were to make a report in the manner specified in section 7 or 8, (I) there is a risk of penalisation, or (II) there is a low prospect of the relevant wrongdoing being effectively addressed, due to the particular circumstances of the case, such as those where evidence may be concealed or destroyed or where a prescribed person may be in collusion with the perpetrator of the wrongdoing or involved in the wrongdoing.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

A reporting person who makes a qualifying protected disclosure under the Protected Disclosures Act 2014, as amended, has the benefit of relatively wide ranging protections under the Act.

They are protected from dismissal for having made a protected disclosure. In addition, they are protected from penalisation or threatened penalisation for having made a disclosure. Penalisation is broadly defined as: “any direct or indirect act or omission which occurs in a work-related context, is prompted by the making of a report and causes or may cause unjustified detriment”. Examples of penalisation include the following acts and omissions:

• withholding of promotion;
• ostracism;
• withholding of training;
• a negative performance assessment or employment reference;
• failure to convert a temporary employment contract into a permanent one, where the worker had a legitimate expectation that he or she would be offered permanent employment;
• failure to renew or early termination of a temporary employment contract;
• harm, including to the worker’s reputation, particularly in social media, or financial loss, including loss of business and loss of income;
• blacklisting on the basis of a sector or industry-wide informal or formal agreement, which may entail that the person will not, in the future, find employment in the sector or industry;
• early termination or cancellation of a contract for goods or services;
• cancellation of a licence or permit; and
• psychiatric or medical referrals.

If a person causes detriment to another person because the other person made a protected disclosure, the reporting person has a right of action in tort against the person by whom the detriment was caused.

The employer also has a duty of confidentiality in relation to the identity of the reporting person.

As outlined above, it is also an offence to:

• hinder or attempt to hinder a worker in making a report,
• penalise or threaten penalisation or cause or permit any other person to penalise or threaten penalisation,
• bring vexatious proceedings against a reporting person,
• breach the duty of confidentiality in section 16 regarding the identity of reporting persons.

All of these offences can attract significant penalties. A person who commits an offence under this section is liable (i) on summary conviction, to a class A fine (a fine not exceeding 5,000 EUR) or to imprisonment for a term not exceeding 12 months, or both, or (ii) on conviction on indictment, to a fine not exceeding 75,000 EUR, 100,000 EUR or 250,000 EUR (depending on the specific offence) or to imprisonment for a term not exceeding 2 years, or both.

In addition, a person who is dismissed or penalised for making a protected disclosure may bring a claim to the Workplace Relations Commission, who may award up to 5 years’ remuneration for a breach of the 2014 Act. The maximum amount of compensation that the Workplace Relations Commission may award to a ‘worker’ who is not in receipt of remuneration from the employer concerned is 15,000 EUR. However, compensation awarded to workers may also be reduced by up to 25 per cent where the investigation of the relevant wrongdoing was not the sole or main motivation for making the protected disclosure concerned.

Whistleblowers can also only apply to the Circuit Court for interim relief to prevent penalisation or dismissal within 21 days immediately following the date of dismissal or the last instance of penalisation or such longer period as the Court may allow.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

The Minister for Public Expenditure and Reform is required to make freely available comprehensive and independent information and advice on the making of protected disclosures and related procedures, the protection against penalisation, the remedies available in respect of penalisation, and the rights of the person to whom the wrongdoing is attributed. The Minister may, by way of regulations, provide guidance on compliance with the obligations contained in the Protected Disclosures Act 2014, as amended. This power has not yet been exercised.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

In order to obtain the protection of the Protected Disclosures Act 2014, as amended, in relation to protection from penalisation, detriment, civil and criminal liability, the reporting person must report the relevant wrongdoing in the manner set out in the 2014 Act, the parameters of which will depend on whether the disclosure is to the employer, a prescribed person, a Minister, a legal advisor, the Protected Disclosures Commissioner or in some other way.

In addition, a reporting person who makes a report containing any information that he or she knows to be false commits an offence. A person who commits such an offence is liable (i) on summary conviction, to a class A fine (a fine not exceeding 5,000 EUR) or to imprisonment for a term not exceeding 12 months, or both, or (ii) on conviction on indictment, to a fine not exceeding 100,000 EUR or to imprisonment for a term not exceeding 2 years, or both.