Whistleblowing

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

As a general rule (article 9 paragraph 4), companies with 50 to 249 employees (regardless of the group) should have the option to share resources as regards the receipt of reports and any investigation to be carried out. Administrative bodies with less than 10,000 inhabitants or less than 50 employees can also pool their resources.

The Commission states that the protection of whistleblowers and a higher number of disclosures will only be achieved if each company having more than 49 employees will establish its own whistleblowing system. According to the current interpretation instructions of the EU Commission regarding the Whistleblowing Directive (dated 2 June 2021 and 29 June 2021), it is not prohibited to establish a centralised system, but such a system must be run in parallel with the mandatory local system.