Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

European Union law primarily regulates the status of whistleblowers in Poland. The relevant law is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (the Whistleblowing Directive).

The Whistleblowing Directive was supposed to be transposed into the Polish legal system by 17 December 2021. The Directive is to be implemented through a separate act (not an amendment of existing laws), supplementing existing regulations and procedures, including those already in force in the financial sector.

A governmental draft bill for the Whistleblowers Protection Act is being developed by the Ministry of Family and Social Policy. The most recent version of the bill is dated 27 March 2023.

This means that the Directive has not yet been implemented into the Polish legal system. 

The following responses are therefore based on the current draft bill legislation of the Ministry of Family and Social Policy unless stated otherwise.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

All legal entities employing more than 50 employees will have to implement a whistleblowing procedure.

There are implemented whistleblowing procedures in certain entities (financial sector, civil aviation sector and others, due to AML procedures) already, according to sectoral regulations. The requirement to establish an internal reporting system applies to some employers, primarily those in the banking and insurance sectors, regardless of the number of employees as of the Act's effective date.

Private sector entities must establish internal reporting regulations upon the entry into force of the Act (no vacatio legis foreseen in this matter).

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

The national legislation does not foresee such a solution. Legal entities in the private sector with between 50 and 249 employees may agree to share resources for receiving and verifying reports and conducting an investigation, provided that the activities performed comply with the Bill.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

There is no specific sanction foreseen in the Bill if the internal whistleblowing procedures will not be implemented within the company.

A fine may be imposed on a person if they are responsible for establishing the procedure, have not established an internal reporting procedure, or the established internal reporting procedure violates the Bill’s provisions. The fine is up to 5,000 Polish zloty.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

The legal entity will determine the internal reporting regulations after consultation with:

• a company trade union organisation or,
• employee representatives selected under the procedure adopted by the employer – if the legal entity does not have a company trade union organisation.

The consultations will last no less than seven days and no longer than 14 days from the date of submission by the legal entity of the draft internal reporting procedure.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

An internal reporting procedure entering into force should be made known to persons performing work in each legal entity, in the manner adopted in the company.

A legal entity will provide information on the internal whistleblowing procedure along with the commencement of recruitment or pre-contract negotiations to a person applying for work under an employment relationship or other legal relationship constituting the basis for the performance of work or services or the performance of a function.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

Employers may outsource maintaining reporting channels (as part of ICT solutions) and receiving reports.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

A legal entity must ensure that the internal procedure and related processing of personal data prevent unauthorised persons from gaining access to the information covered by the report and ensure that the confidentiality of the identity of the person making the report and the person to whom the report relates is protected. Confidentiality protection applies to any information from which such persons can be directly or indirectly identified.

Only persons authorised in writing by the employer may receive and verify reports, take follow-up action, and process the personal data of the whistleblower or the subject of the report. Authorised persons must maintain secrecy, even after the termination of the employment relationship or other legal relationship under which they performed such work.

The whistleblower’s personal data and other identifiable data may not be disclosed except with the express consent of the reporter. It does not apply where disclosure is necessary and proportionate under the law in the context of investigations or judicial proceedings carried out by public authorities or the courts, including to ensure the right of defence of the reported person. A legal entity, upon receipt of a notification, may collect and process the personal data of a person to the extent necessary to fulfil the purposes of the Bill. Personal data that is not relevant to the processing of the notification will not be collected, and if accidentally collected, will be deleted immediately. Also, the GDPR applies, with some exceptions specified in the Bill (eg, if the applicant does not meet the conditions indicated in article 6 or has expressly consented to the disclosure of his or her identity).

The legal entity must keep a register of internal reports, including:

• the number of the notification;
• the subject of the violation;
• the personal data of the reporter and the person affected by the report, necessary to identify them;
• the contact address of the reporter;
• the date of the initial internal report;
• information on follow-up actions taken; and
• the date on which the case was closed.

Personal data and other information in the register of internal reports should be retained for three years after the end of the calendar year in which the follow-up actions were completed or after the completion of the proceedings initiated by these actions.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

The legal entity will ensure that the internal reporting procedure and the related processing of personal data prevent unauthorised persons from gaining access to the information covered by the report and protect the confidentiality of the identity of the reporting person, the person concerned, and the third party indicated in the notification.  Confidentiality protection relates to information that identifies such persons, directly or indirectly.

The employer may create an impartial, internal unit or person within the structure of the legal entity, authorised to undertake follow-up actions.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

Breaches of:

• public procurement;
• financial services, money laundering, and terrorist financing;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiation protection and nuclear safety;
• food and feed safety, animal health and welfare;
• public health;
• consumer protection;
• protection of privacy and personal data, and security of network and information systems;
• rules for the protection of financial interests of the EU related to the fight against fraud, corruption, and any other illegal activity affecting EU expenditures or revenue;
• the functioning of the internal market;
• EU competition law and state aid rules;
• corporate tax laws; and
• violations concerning the financial interests of the treasury of Poland or a local authority unit.

According to the provisions of the EU Whistleblower Directive, the draft bill also includes a list of violations that primarily relate to relevant legal disciplines.

The employer may additionally establish reporting of violations other than those indicated in the Directive, including those relating to the employer's internal regulations or ethical standards.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

Regarding the internal reporting procedure, the Bill itself does not differentiate between different industries. However, sectoral whistleblowing regulations cover the banking and financial sector, insurance sector, and civil aviation sector, combating unfair competition and AML-obliged entities.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

There is no legal definition of a whistleblower. The Act applies to any individual who reports or publicly discloses information about a violation of the law obtained in a work-related context.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

According to the Bill, a whistleblower can be an individual who reports or publicly discloses information about a violation of the law obtained in a work-related context, including:

• an employee and temporary employee;
• a person applying for employment who obtained information about a violation of the law in the process of recruitment or negotiations preceding the conclusion of a contract;
• a person providing work on a basis other than an employment relationship, including a civil law contract;
• an entrepreneur;
• a shareholder or partner;
• a member of a body of a legal person;
• a person providing work under the supervision and management of the contractor, subcontractor, or supplier, including based on a civil law contract;
• a trainee;
• a volunteer;
• an intern.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

A whistleblower is subject to the protection of the Bill, provided that he or she had reasonable grounds to believe that the information that forms the subject of the report or public disclosure was true at the time the report or public disclosure was made and that such information constitutes infringing information. The information must have been obtained by the person providing it during their professional activity or in the context of their professional activity.

For an external report, the reporting person is protected upon the issuance of a certificate by the competent public authority, after receiving from the reporting party a statement made under penalty of perjury that the information about the violation that is the subject of the report was true at the time of reporting.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

The Polish legislature did not decide to introduce anonymous reports as a rule. To make an effective report, the whistleblower must provide data identifying themselves, including contact details. That means anonymous reports can be left unacknowledged. If a company decides to handle anonymous reports, appropriate regulations for this must be included in its internal reporting procedure (see more: the Bill's justification).

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

The bill does not establish any requirements in this regard, so the whistleblower need not be a direct witness of the violation. They must, however, have gathered information about irregularities in connection with activities at the company.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

In general, the whistleblower procedure requires that the personal and material scope of the Whistleblower Protection Act be applied. The whistleblower must have obtained information about infringements at a company while participating in professional activities or in advance of engaging in such activities.

A whistleblower can report through:

• an internal notification – oral or paper, or electronic communication – to a legal entity;
• external notification – informing the National Labor Inspectorate , a public body orally, or the Police (when the report concerns a crime), on paper or electronically about a violation;
• public disclosure - informing the public of the violation.

A legal entity has to introduce an internal reporting procedure, which should include, among others:

• an internal organisational structure, including a person within the organisational structure of the legal entity or an external entity authorised to receive reports;
• methods to report internally; and
• clear information on how to make external notifications to public authorities and, where appropriate, to institutions, bodies, offices, or agencies of the European Union.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

A whistleblower may report externally without using an internal channel first. The external notification is accepted by the National Labor Inspectorate, a public authority or the Police.

A person who makes a public disclosure will qualify for protection under this Directive if any of the following conditions are fulfilled:

• the person first reported internally and then externally, or directly externally under the Bill, but no appropriate action was taken in response to the report within the timeframe referred to in the Bill, unless the whistleblower has not provided a contact address to which the follow-up information should be provided; and
• the whistleblower has reasonable grounds to believe that:
  • the breach may constitute an imminent or manifest threat to the public interest, such as where there is a risk of irreversible damage; or
  • in the case of external reporting, there is a risk of retaliation or there is a low prospect of the breach being effectively addressed, due to the particular circumstances of the case, such as where evidence may be con­cealed or destroyed or where an authority may collude with the perpetrator of the breach, or anyone involved in the breach.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

The internal investigation bodies can carry out a variety of follow-up actions after the reporting procedure has been completed. The Bill does not specify any particular circumstances in which companies must notify authorities about whistleblowing. Nevertheless, if the reported act or omission is a criminal offence, the employer should notify the public prosecutor. In addition, if the disclosed act or omission could be recognised as an administrative infraction, the appropriate state authority should be notified.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

If the whistleblower knows that the information they are sharing is untrue, they may be subject to a fine, restriction of liberty or imprisonment for up to two years.

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

The Bill prohibits retaliation against whistleblowers. Anyone who obstructs an act of whistleblowing will be subject to a fine or the restriction of liberty or imprisonment for up to a year. If violence, threats or deception are used, he or she will be subject to imprisonment for up to three years.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

A whistleblower will be protected if he or she had reasonable grounds to believe that the information shared is true at the time of the report or public disclosure and that such information constitutes an infringement.

For an external report, the reporting person is protected upon the issuance of a certificate by the competent public authority, after receiving from the reporting party a statement made under penalty of perjury that the information about the violation that is the subject of the report was true at the time of reporting.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

The prohibition of retaliation against a whistleblower is the most fundamental component of the protection. No retaliatory action, including threats or attempts to take such action, may be taken against the whistleblower under the Bill.

If the work has been, is, or will be performed based on an employment relationship, no retaliatory action may be taken against the whistleblower, in particular in the form of:

• refusal to establish an employment relationship;
• termination of the employment relationship or termination without notice;
• not concluding a fixed-term employment contract or an indefinite-term employment contract after the termination of a probationary period contract, not concluding another fixed-term employment contract, or not concluding an indefinite-term employment contract after the termination of a fixed-term contract – if the employee had an expectation that such a contract would be concluded;
• reduction of remuneration for work;
• withholding a promotion or being passed over for promotion;
• omission in the award of work-related benefits other than remuneration or a reduction of the number of such benefits;
• transfer of an employee to a lower position;
• suspension from performing the duties of an employee or official;
• transfer of the employee’s current duties to another employee;
• unfavourable change of the place of work or work schedule;
• negative evaluation of work performance;
• imposition or application of a disciplinary measure, including a financial penalty or measure of a similar nature;
• coercion, intimidation, or exclusion;
• mobbing;
• discrimination;
• adverse or unfair treatment;
• withholding of participation in training to improve professional qualifications;
• unjustified referral for medical examination, including psychiatric examination, provided that separate regulations provide for the possibility to refer an employee for such an examination;
• actions aimed at making it difficult to find future employment in a given sector or industry based on an informal or formal sectoral or industry agreement;
• causing financial loss, including economic loss or loss of income; or
• causing other intangible harm, including damage to reputation, especially on social media.

If the employer or other employees are accused of any of the above, they will need to prove their actions were motivated by objective and duly justified reasons. The employer will bear the burden of proof that the action taken was not retaliatory.

If the work or service was, is or is intended to be provided based on a legal relationship other than an employment relationship, the filing of a report or public disclosure may not, in particular, provide grounds for:

• the termination, rescission, or termination without notice of a contract to which the whistleblower is a party, particularly concerning the sale or delivery of goods or the provision of services; or
• imposing an obligation or a refusal to grant, restrict or withdraw an entitlement, in particular a concession, permit, or relief.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

If a whistleblower suffers from retaliatory action, they have the right to compensation in full.

A whistleblower cannot be liable for any civil or criminal fines or penalties, including damages, and disciplinary liability, if they had reasonable grounds to believe that the reporting or public disclosure was necessary to disclose a violation of the law under the Bill. In the event of legal proceedings relating to the liability referred to above, the whistleblower may request the discontinuation of such a proceeding.

It is impossible to waive any of the rights set out above or accept liability for damages caused by the reporting or public disclosure. This does not apply to accepting liability for damages caused by knowingly reporting or disclosing false information to the public.

The provisions of employment contracts, other documents on which the employment relationship are created, or that shape the rights and obligations of the parties to the employment relationship, that directly or indirectly exclude or limit the right to make a notification or public disclosure or provide for the application of retaliatory measures, are null and void.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

If the procedure is not followed, a whistleblower's report may not be officially recognised, placing the would-be whistleblower at risk of not gaining protection and supportive measures.

Moreover, if the whistleblower intentionally reports untrue information, they may be subject to a fine, the restriction of liberty, or imprisonment for up to two years.