Whistleblowing

This guide will only focus on the private sector. The EU Whistleblower Directive was transposed into Belgian legislation by the Act of 28 November 2022 on the protection of reporters of breaches of Union or national law established within a legal entity in the private sector. This Act was published in the Official State Gazette on 15 December 2022. It mostly complies with the provisions of this Directive, but also offers greater protection for whistleblowers.

In Croatia, the status of whistleblowers and whistleblower protection (WBP) is governed by the Act on the protection of persons who report irregularities (WBP Act). The WBP Act came into force on 23 April 2022 and replaced the previous Croatian WBP legislation of 2019, introducing amendments to implement Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law (the Directive).

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

All legal entities, including companies, with 50 or more employees (ie, full-time equivalents (FTEs)) will have to implement an internal reporting channel. This threshold of 50 FTEs will be calculated in the same way as the rules for social elections prescribe. This means that they will look at the average employment over a reference period. Legal entities with more than 250 employees will have to set up an internal system by 15 February 2023, legal entities employing between 50 and 249 employees still have until 17 December 2023 to do so.

Under the WBP Act, a whistleblowing procedure must be implemented by:

• any company falling within the scope of EU acts referred to in Part I.B and Part II of the Annex to the Directive, regardless of the number of employees employed by the  company; and
• any company employing 50 or more employees.

Under unofficial interpretations by the officials of the Croatian Ministry of Justice and Public Administration (the Ministry), where applicable, the headcount threshold should take into account only persons employed with the company (ie, persons engaged by the company based on an employment contract) and ordinarily working for the company anywhere in the world (ie, it does not include persons engaged otherwise, such as temporary agency workers or persons engaged by the company’s group company).

To implement the whistleblowing procedure, the company must adopt a whistleblowing policy establishing procedural rules and appoint a person competent for receiving and following up on whistleblowing reports, communicating with the whistleblowers and conducting the protection procedure in connection with the whistleblowing report (WBP officer) and their deputy.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

Companies with less than 250 employees will be able to share an internal reporting channel. Legal entities with more than 250 employees will need to have their own internal reporting procedure. The EU Commission has confirmed in an opinion that it will not allow centralised internal reporting systems for a whole group of companies. However, that does not mean that a group cannot provide the framework and policies for the internal procedures of its subsidiaries, provided employees can make reports and receive a decent follow-up at the local entity level. It is also possible to outsource the internal reporting channel to a third party.

Yes, it is possible to have a whistleblowing procedure applicable at a Group level, but only in addition to an internal reporting channel. This is because the WBP Act states that each company must have its own internal reporting channel (meaning a WBP officer and their deputy appointed by the company). However, neither the Directive (as interpreted by the European Commission) nor the WBP Act prohibits the company from having a separate central reporting channel at a Group level, provided that such a channel is available in addition to (co-existing with) a reporting channel set up under Croatian law.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

The absence of an internal reporting channel can be sanctioned with  a penal sanction which could lead to a prison sentence of 6 months to 3 years, a penal fine of 4,800 to 48,000 EUR per worker involved (with a max. of 100 workers) or an administrative fine of 2,400 to 24,000 EUR per worker involved (with a max. of 100 workers).   

Yes, a failure by the company to adopt or implement an internal whistleblowing policy by 23 June 2022, or appoint a WBP Officer and their deputy by 23 July 2022 may each result in liability for an administrative offence and a related fine, which may be up to about 4,000 EUR for the  company, and up to about 1,350 EUR for the responsible individual within the company.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

There has to be a consultation of the social partners for the establishment of an internal reporting procedure. This means that the employer will have to consult the works council. If there is no works council (less than 100 employees), they will consult the trade union delegation. If there is no trade union delegation either, the health and safety committee can be consulted. This right to consultation does not mean that these representative bodies have a veto right or a decision power, but they have the right to give their opinion on the proposed system. Ideally, the employer will take their remarks into consideration.

Yes, the involvement of employee representative bodies (the works council or, if there is no works council, a union trustee), provided that any such body exists with the  company, is two-fold:

• the company must consult with the works council or union trustee regarding adoption of the whistleblowing policy – failure to do so would result in the adopted whistleblowing policy being null and void; and
• the company must appoint the persons requested by the works council or union trustee as the WBP Officer and deputy; if no such request is made by the works council or union trustee, the  company may appoint the WBP Officer and deputy at its discretion.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

The company needs to provide clear and accessible information regarding the use of the internal reporting channel. This can be done in a written policy or even in the internal work rules (but this is not necessary). The company should also inform workers about the possibility of reporting externally to the relevant authorities.

The WBP Act does not contain rules on how the whistleblowing policy should be communicated to employees and other eligible whistleblowers, other than stating that the policy should be easily accessible to all persons within the work environment (as defined in question 12), understandable, and effective in encouraging the primary use of internal reporting channels or systems for reporting breaches or irregularities. In light of this, the publication of the whistleblowing policy should be made following the provisions of Croatian labour legislation.

Under the Croatian Employment Act and implementing regulations, any employment-related policy (which would include the whistleblowing policy) must be signed by the management of the company and published on a bulletin board in the company’s premises (specifically stating that the policy will come into force on the ninth day after publication, at the earliest). It is recommended that all eligible whistleblowers (ie, both employees of the company, and persons not employed by the company) are notified of the company having in place a whistleblowing policy and that they can receive a copy of such policy upon their request.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

The reporting channel can be outsourced to a third party (eg, to a payroll provider, compliance experts or lawyers). However, the employer will remain legally responsible for the implementation and use of the system.

Under the WBP Act, the internal reporting channel is a WBP officer and their deputy, as appointed by the company. This officer and deputy are solely authorised to receive the whistleblowing reports and conduct investigations (ie, the conduct of these actions cannot be outsourced to any third person).

However, the WBP Act does not preclude companies from appointing individuals employed or hired by an external service provider as a WBP officer or deputy (noting, however, that the company may make such appointment at its own discretion only if these appointments have not been proposed by either the works council, or, if there is no works council, the union trustee, or if there is no works council or union trustee, by at least 20% of the  company’s employees).

Even if the company appoints individuals employed or hired by an external service provider, the appointed persons must keep confidential the identity of any whistleblowers and any information contained in the whistleblowing report, and will not be able to directly involve external service providers in the investigation without express consent from each whistleblower. However, the  company may engage an external service provider to indirectly assist these appointed persons (regardless of whether the individuals appointed are employed by the  company or by the external service provider, and regardless of whether the whistleblower provides express consent for disclosure of his or her identity and the content of the report), if such assistance will not lead to disclosure to that provider of the identity of the whistleblower and any information contained in the whistleblowing report.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

There is an obligation to register the reports made with the internal reporting system. The processing of the reports should conform with the GDPR. The Act is very brief on this and does not offer much guidance. However, the company must have a processing basis as the federal whistleblowing law requires this. Personal data not relevant to the processing of a report should not be collected and, if collected in error, should be deleted. The registered reports should not be stored longer than necessary in the system. The name, position and contact details both of the reporter and each person covered by the protection and support measures and of the data subject, including, where applicable, the company number, shall be kept up to date until the expiry of the limitation period for the reported breach.

The WBP Act does not provide for any specific obligations concerning the protection of data collected related to the whistleblowing procedure, other than that any processing of personal data must be carried out under EU and national laws regulating the protection of personal data.

In light of this, the record-keeping of collected data must be conducted in a way that access to records is restricted to authorised persons (ie, the WBP officer and their deputy) and that appropriate measures concerning the storage of documents (for example storage cabinets with locks and password-protected databases) are taken to prevent unauthorized access. The retention period has not been specified by either the WBP Act or any guidelines or regulations issued by the competent authorities. Consequently, it is advisable that the retention period is provided in the WBP policy and that the collected data is retained for no longer than five years since receipt of the report or until completion of any legal proceedings associated with the report, whichever is longer.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

Companies should draft a clear and accessible policy that outlines the procedure. The deadlines of the procedure need to be respected and the policy should clarify which situations fall under the scope of the procedure and the fact that reports will enjoy certain protections against retaliation. To implement the procedure itself, bigger companies are advised to use a digital reporting tool as it could be too complicated to use a non-digital system for a large number of employees, which could lead to errors in the procedure and missing deadlines. There are lots of tools out there, from quite simple ones to very intelligent (but also expensive) ones. The company will have to do some market research to find the tool that meets its specific needs. In case not all employees have access to the internet or computers, it is highly recommended to also prove a telephone line as a reporting option.

The following precautions should be taken into account by the company when setting up a whistleblowing procedure:

• Language of the whistleblowing policy – even though the WBP Act does not explicitly provide that the whistleblowing policy must be available in Croatian, the WBP Act requires that information on the internal whistleblowing procedure must be easily accessible, understandable and effective. If the whistleblowing policy is not prepared in Croatian, the company may run the risk of: the employee claiming that he or she did not properly understand the policy; or in the case of inspection or dispute, the inspection body or court holding that a policy made only in English, or a language other than Croatian, is null and void as not being easily understandable.
• Appointment of WBP officer and deputy – given that a company must appoint a WBP officer and their deputy at the request of either the works council, union trustee, or 20% of employees of the company (if there is neither a works council nor union trustee), it is advisable that the  company provides in the whistleblower policy that any candidate should be a person of trust and competent to conduct the duties of a WBP officer.
• WBP officer’s resources – the company must ensure that the WBP officer and their deputy have the resources required to effectively perform their duties, such as providing the officer with a personal computer or laptop and a separate email address for receiving whistleblowing reports, a direct telephone line for receiving whistleblowing reports, a dedicated office for conducting meetings with whistleblowers, and equipment for keeping records of reports.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

Belgium has copied the list of the EU directive, but has expanded this with some very important domains. The breaches in the following fields of law (domains) fall under the material scope of the Whistleblower Act:

• public procurement;
• financial services, products and markets and the prevention of money laundering and terrorist financing;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiation and nuclear safety;
• food and feed safety, animal health and welfare;
• public health ;
• consumer protection;
• protection of privacy and personal data and security of networks and information systems;
• combating tax fraud; and
• combating social fraud.

Compared to the EU Directive, the two last fields were added. For employers, the social fraud domain is especially interesting as this includes (non-exhaustively) all breaches of the Social Penal Code and all breaches of the statute of independent workers. The Social Penal Code provides for sanctions for breaches of almost all provisions of social law (employment law and social security law); moreover, article 1 of the Social Penal Code defines social fraud as any breach of social legislation that falls under the competence of the federal government. This means that almost all breaches of social laws will fall under the scope of the whistleblowing procedure.

The material scope of the WBP Act encompasses the following breaches or violations (under the WBP Act they are named “irregularities”):

• related to the scope of application of the EU Acts listed in Part I of the Annex to the Directive;
• affecting the financial interests of the EU, as stated in article 325 of the Treaty on the Functioning of the European Union and further defined by relevant EU measures;
• relating to the internal market, as stated in article 26(2) of the Treaty on the Functioning of the European Union, including breaches of EU rules on competition and state aid, and breaches of corporate tax rules or arrangements to create a tax advantage contrary to the applicable corporate tax legislation; and
• relating to other rules of Croatian law, the breach of which undermines the public interest.

The WBP Act defines the term “irregularities” as actions or omissions that are unlawful and relate to or are incompatible with the goal or purpose of the above-stated legislation.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

The Whistleblower Act provides for an extra strict enforcement mechanism for companies active in financial services, products and markets and for rules for the prevention of money laundering and terrorist financing. So the financial and banking sector is under additional scrutiny. However, the procedures stay mostly the same.

Yes, the WBP Act specifically excludes its application in the matters of defence and national security, except where such matters are covered by Union acts listed in Part I of the Annex to the Directive. Furthermore, the governmental bodies competent for matters of defence and national security must regulate the protection of whistleblowers and the reporting procedure in the areas of key security and defence interests (specifically the protection of key security and defence interests). To our knowledge, there are still no adopted or publicly available regulations covering WBP and reporting procedures in the areas of key security and defence interests.

In addition, if the Union acts listed in Part II of the Annex to the Directive provide for separate rules on reporting irregularities, the WBP Act restricts its application only to matters that have not been regulated by such separate rules.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

The legislative proposal defines a “reporter” as “a person who reports information about breaches or makes them public”.

Under the WBP Act, a whistleblower is defined as a natural person who reports or publicly discloses irregularities that he or she has learned of within his or her work environment, whereas the term work environment is defined as professional activities in the public or private sector, irrespective of the nature of such activities, within which the whistleblower acquires information on irregularities and within which the whistleblower could suffer retaliation if they reported such irregularities, including when such activity has ceased in the meantime, should start or should have started.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

The personal scope is very broad: it can be employees (workers); independent workers; shareholders; members of administrative, management or supervisory bodies; volunteers and interns (paid or unpaid); any person working under the supervision and direction of contractors, subcontractors and suppliers; ex-employees; or employment candidates. However, companies do not have to make their internal reporting channels accessible to persons other than their employees (the other persons can use the external system).

Any person that acquires knowledge of or information on irregularities within their work environment and reports such irregularities under the prescribed reporting procedure may be considered a whistleblower. This includes:

• persons within an employment relationship;
• persons with the status of a self-employed person;
• holders of stocks in a joint-stock company or holders of shares in a limited liability company, as well as persons who are members of the administrative, management or supervisory body of a company, including non-executive members, volunteers, and paid or unpaid interns;
• persons working under the supervision and direction of contractors, subcontractors and suppliers; and
• persons that in any way participate in the activity of the legal or natural person.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

The reporting should happen in a work-related context (except for financial fraud). There are two main conditions for receiving protection as a whistleblower. First, the reporter needs to have a reason to believe that the reported information on infringements was correct at the time of reporting and the information has to fall within the material scope of the Act. This will be assessed in light of a person with a similar situation and knowledge and the protection will be granted even if the reported information is later proven to be wrong. Second, the whistleblower has to follow the legal procedure for internal or external reporting or disclosing information publicly.

Yes, persons reporting or publicly disclosing irregularities will be considered to be whistleblowers if they:

• had a legitimate reason to believe that what they report or publicly disclose is true at the time of making the report or disclosure;
• had a legitimate reason to believe that the information falls within the scope of the WBP Act; and
• make the report or public disclosure as per the rules set by the WBP Act.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

Companies with under 250 employees can choose whether or not they will allow anonymous internal reporting. Companies with 250 or more employees will have to allow it. In any case, reporters can always anonymously report externally to the competent reporting authority.

Yes, anonymous whistleblowing reports are admissible, but the company is not legally required to investigate an anonymous report. This is because the WBP Act states that a whistleblowing report must contain information on the identity of the whistleblower, and the company may deem that an anonymous report does not represent a qualifying whistleblowing report. In any case, the WBP Act extends its protection to persons who submitted an anonymous report if the identity of that person becomes known.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

There is no such condition.

No, the WBP Act expressly provides that the information on the irregularities (i.e., breaches/violations) contained in the whistleblowing report may also include reasonable doubt on actual or potential irregularities that occurred or are very likely to occur, or on attempts to cover-up such irregularities.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

There are two main systems of reporting, the internal reporting procedure within a legal entity and the external reporting procedure (to a competent authority).

Concerning the internal reporting channel, the company must provide a protected and confidential reporting system. This is a channel for receiving reports that, by its design, structure and management, securely protects the confidentiality of the reporter and any third party named in the report, and to which unauthorised personnel do not have access. The reporting can take place verbally, in writing or both (so companies can choose the method). If verbally, this can be by telephone, another verbal system (eg, digitally) or through a meeting (but only at the request of the reporter and within a reasonable term).

Within seven days, the reporter needs to receive confirmation of receipt of the report. Next, the company should assign a “reporting manager” or “whistleblower officer” who can act independently and who does not have a conflict of interest. Instead of one person, it can also be a team (eg, a compliance team). This person or team will lead the “investigation” regarding the reported breaches and will be responsible for the careful follow-up of the report. This careful follow-up is defined as “an action by the recipient of a report to check the accuracy of the allegations made in the report and to address the reported infringement where appropriate, including through measures such as an internal preliminary investigation, an investigation, prosecution, recovery of funds or termination of the proceedings. Within three months after the confirmation of receipt, the reporter needs to receive feedback from the reporting manager. Feedback is defined as “providing the reporter with information on the follow-up as planned or taken and on the reasons for this follow-up”.

Concerning external reporting, a reporter can report to a competent authority after the internal reporting or immediately (without reporting internally). The competent authority (it is not yet fully clear which institution this will be, but in most cases this will probably be the federal ombudsman) also has to establish an independent and autonomous reporting system. Like internal reporting, there needs to be a confirmation of receipt within seven days following the reporting and feedback within three months after this confirmation. However, the competent authority can prolong this deadline (if required) to six months. Furthermore, the competent authority has to inform the reporter of the result of its investigation (if legally possible), so the procedure does not stop per se at the moment of feedback within three or six months. The competent authority can dismiss reports if it does not consider the report to contain meaningful information (but this has to be communicated to the reporter) and it can prioritise reports concerning severe breaches.

There is also a third procedure, namely the public disclosure of the information (eg, in the press, online or in a book or magazine). Reporters who publicly disclose information in this manner will be protected by the law if they follow certain conditions. If there is indirect disclosure (after an internal or external reporting procedure), the reporter will be protected if there have been no appropriate measures taken by the company concerning the report. If there is direct disclosure (without following the internal or external procedure first), the reporter will be protected if there is an urgent or real danger to the public interest or if there is a risk of retaliation if the information is reported externally, or if an appropriate reaction is unlikely. This will be the case in specific circumstances (eg, when there is a risk that the evidence will be destroyed or when there is collusion between the competent authority and the person or entity who has breached the rules). 

The whistleblowing procedure must be regulated by a whistleblower policy adopted by the company. In practice, the policy should include provisions regulating eligible whistleblowers; methods of reporting; the content of the whistleblowing report; the procedure for submitting, following up on and investigating the whistleblowing report with all applicable deadlines; and the appointment of a WBP officer and a deputy.

• Eligible whistleblowers - please see answers to questions 12 and 13;
• Methods of reporting - the whistleblowing report may be submitted either in writing (including e-mail communication) or verbally (meaning via a telephone call or voice message, or in a physical meeting if so requested by the whistleblower);
• Content of the whistleblowing report - the whistleblowing report should contain information on the identity of the whistleblower, information on the reported body or person (ie, the body or person who committed irregularities), and information on the irregularities.
• Procedure for submitting, following up on and investigating the whistleblowing report – after receiving the report, the WBP officer or their deputy must:
  • acknowledge receipt of the report within seven days;
  • without delay undertake actions within the officer’s competence as required to protect the whistleblower;
  • undertake actions required to investigate the reported irregularities and provide feedback to the whistleblower generally within 30 days, but in no case later than 90 days from the date of acknowledgement of receipt of the report, or if no acknowledgement was sent to the whistleblower, 90 days from the end of the seven-day period after the report was made;
  • without delay, forward the report to competent authorities for further processing if the irregularities have not been resolved in cooperation with the company;
  • without delay, notify the whistleblower in writing of the outcome of the investigation;
  • notify in writing the authority competent for external reporting on received reports within 30 days of a decision on the report;
  • keep confidential the identity of the whistleblower and all information contained in the report as required by the law; and
  • provide clear and easily available information regarding the procedure for submitting a report to the competent authority for external reporting and, as appropriate, institutions, bodies, offices or agencies of the European Union competent to take further action following the content of the report;
• Appointment of a WBP officer and a deputy – the company must appoint a WBP officer and deputy at the request of a works council. If there is no works council, then a union trustee would make the request. If there is no works council or union trustee, then 20% of employees of the company would make the request. The appointed officer and deputy must provide written consent for the appointment. If any of the above does not request the appointment of an officer or deputy, the company may make the appointment at its discretion. If the WBP officer and deputy are appointed, and at any time the works council, union trustee or the abovementioned proportion of employees make a written request to the company proposing that any other persons be appointed as WBP  officer and deputy, the company must make the necessary replacements.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

There is a certain preference to start with an internal reporting procedure. However, the reporter does have the choice to immediately opt for external reporting and this choice does not have to be justified.

No, there is no hierarchy between the internal and external reporting channels, meaning that a whistleblower is completely free to choose whether to make a report internally or externally. On the other hand, the whistleblower may only publicly disclose irregularities if:

• the whistleblower already submitted an external whistleblowing report (regardless of whether they first submitted an internal report), but no appropriate measures were undertaken in response to the report; or
• the whistleblower did not submit an external whistleblowing report but has reason to believe that:
  • the irregularity represents an immediate and obvious danger to the public interest, for example in case of a crisis situation or risk of irreparable damage; or
  • if submitting an external whistleblowing report, there is a risk of retaliation or the prospect of the issue being remedied is low due to the special circumstances of the case.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

If the investigation of a report leads to the uncovering of severe legal breaches or crimes, there could be a duty for the employer or company to inform the authorities, but this will depend on each case.

Yes, under the WBP Act it is the duty of WBP officer and deputy to:

• forward the report to competent authorities for further processing if the irregularity has not been resolved in cooperation with the company; and
• notify in writing the authority competent for external reporting on the report and the outcome of the actions undertaken within 30 days after a decision on the report is made.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

Whistleblowers cannot be sanctioned if they had reasonable grounds to believe that the information on breaches they reported was true at the time of the reporting. This should be judged in light of a person in the same situation and with the same knowledge as the employee. If this is not the case, the whistleblower falls outside the scope of the protection for reporters and therefore could be sanctioned, if necessary.

No, whistleblowers cannot be sanctioned for submitting a whistleblowing report or publicly disclosing irregularities (regardless of whether or not the facts are confirmed or such facts constitute an infringement), unless it can be proven that the whistleblower did not have a legitimate reason to believe that the information on irregularities was true at the time of making the report or disclosure, or did not have a legitimate reason to believe that the information falls within the scope of the WBP Act.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

Any obstruction of a report (by any natural or legal person) can be sanctioned by a prison sentence of between six months and three years and a fine of between 4,800 EUR and 48,000 EUR.

Obstruction by other employees can also lead to disciplinary actions by the employer against these persons.

If the company undertakes actions that constitute an obstruction of the whistleblower (for example, preventing or attempting to prevent the submission of a report, undertaking malicious processes against the whistleblower or retaliation against the whistleblower), the company may be fined up to about 6,700 EUR and the individual responsible with the company may be fined up to about 4,000 EUR.

Furthermore, any decision or other document provided by the company, or any legal transaction, whereby the  company retaliates against the whistleblower or person related to or connected with the whistleblower will not have any legal effect.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

Please consult the conditions in question 14.

To receive protection as granted under the WBP Act, the whistleblower must either:

• submit an internal whistleblowing report as per the whistleblowing procedure established by  company and the WBP Act;
• submit an external whistleblowing report to the competent authority for external reporting (which in Croatia is the Croatian Ombudsman) as per the regulations adopted by that authority and the WBP Act; or
• publicly disclose information on irregularities as per the WBP Act (please see question 18).

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

The scope of the protection is very large. There is a general prohibition against any retaliation measure against the reporter. This means that any direct or indirect act or omission arising from an internal or external report or public disclosure, which may cause unjustified harm to the reporter, is prohibited. This includes (non-exhaustively): dismissal, suspension, demotion, refusal of promotion, transfer of duties, change of place or time of work, reduction of pay, deprivation of training, negative appraisal, disciplinary action, coercion, intimidation, harassment or exclusion, discrimination, non-conversion or non-renewal of a temporary employment contract, damages (including damage to reputation or loss of income), disciplinary hearing, termination of a service contract, revocation of a licence or permit and referral to psychiatric or medical care.

The legislative proposal does not provide a limited timeframe for this protection.

Any whistleblower may complain to the Federal Coordinator (part of the Federal Ombudsman) if he or she feels victimised or threatened with reprisals. The Federal Coordinator will initiate an extrajudicial procedure to verify the existence of a suspected reprisal. The burden of proof that no reprisal has occurred is on the legal entity. If there is a reasonable suspicion of retaliation, the federal coordinator will give recommendations within 20 days of receipt of a report from the head of the company. These recommendations will be addressed to the head of the legal entity to reverse the retaliation or remedy the harm. The head has 20 days to accept or reject these recommendations. If this procedure is insufficient, the reporter (supported by the competent authority) can go to the Labour Court.

Before the Labour Court, if the reporter proves that he or she has made a report or disclosure, it is presumed that the harm he or she has suffered is in retaliation to the report (the employer may prove the contrary by giving justified reasons). The reporter can claim contractual or extra-contractual damages. This can be a lump sum of 18 to 26 weeks' wages if the claimant is an employee (otherwise, the victim must prove the extent of the damage). The legislative proposal also includes a lump sum of six months' compensation or damages if the report is related to financial services or money laundering and terrorist financing. In these circumstances, the law also provides for a right to request reinstatement in the event of dismissal. If no reinstatement is granted, he or she will be awarded an additional six months' salary (including benefits) or compensation for the actual proven damage.

Regarding the personal scope of protection, the  company is prohibited from retaliation, attempted retaliation or threatened retaliation against the whistleblower; any person assisting the whistleblower; persons connected with the whistleblower (for example, relatives or colleagues of the whistleblower); legal entities that the whistleblower owns, works for, or is otherwise connected with within the work-related environment; and the WBP officer and their deputy.

Concerning the material scope of protection, the following is a non-exhaustive list of what is considered retaliation under the WBP Act:

• suspension, termination, revocation or equivalent action;
• demotion or denial of promotion;
• transfer of duties, change of work location, salary decrease, change of working hours;
• denial of professional training;
• negative work performance ratings or negative employment recommendations;
• imposition or adoption of a disciplinary measure, reprimand, or other sanction (including financial sanctions);
• coercion, intimidation, harassment, or isolation;
• discrimination, being put at a disadvantage or unfair treatment;
• refusal to conclude an employment contract for an indefinite duration (if the legal requirements of this were met and the employee had a reasonable expectation that such a contract would be offered to him or her);
• refusal to conclude a consecutive fixed-term employment contract or the termination thereof;
• causing damage (including damage to reputation), especially via social media, or causing financial loss (including loss of business or loss of income);
• blacklisting the person within a sector or industry;
• premature termination of any contract for procurement of goods or services, or the cancellation thereof;
• cancellation of a licence or permit; and
• referral to a psychiatric or medical assessment.

Should a person entitled to protection under the WBP Act suffer retaliation (including if the retaliation is only attempted or threatened), they may initiate court proceedings asking the court to: establish that the person suffered retaliation; prohibit further retaliation and undo the consequences of retaliation; award damages; or order the publication of the judgment confirming that the protected person's rights have been violated. In addition, protected persons may also ask the court to impose interim measures either before, during or after court proceedings (until enforcement is carried out).

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

Competent authorities or the federal Institute for the protection and promotion of Human Rights can award support measures to reports, like:

• comprehensive and independent information and advice on available remedies and procedures;
• technical advice before any authority associated with the report;
• legal assistance;
• support measures;
• financial assistance in legal proceedings; and
• assistance with any administrative or judicial authority concerned with protection against retaliation.

In addition to protection of identity and confidentiality, judicial support, and the right to compensation, whistleblowers have the following support measures: free primary legal aid; the possibility of being granted secondary legal aid; an exemption from the payment of court fees; and emotional support (which will be further defined in a supporting regulation yet to be adopted by the Ministry).

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

In this case, the whistleblower will fall outside of the scope of the Act and thus the protection for whistleblowers. If the abusive reporting is sufficiently severe or has significant consequences, the employer could take disciplinary measures against the reporter or dismiss the reporter (even with urgent cause, if possible). Next, the company can also demand compensation for the damage caused by the abusive reporting (especially if the reporter is not an employee). In any case, it will be difficult to prove that the reporter has abused his right to report.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.