Whistleblowing

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

The legal framework governing the status of whistleblowers in Malta is set out in the Protection of the Whistleblower Act (Chapter 527 – the Act). Originally promulgated on 15 September 2013 by Act VIII of 2013, the Act protects a whistleblower from action an employer may pursue in retaliation for a protected disclosure and is intended to encourage persons to disclose any improper practice witnessed in a work-related context. Maltese law has, therefore, made provisions for whistleblowing procedures since 2013.

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (the Directive) was adopted by the European Parliament and the Council on 23 October 2019. As a member state of the EU, Malta has transposed the provisions of the Directive, which recognises the key role of the whistleblower in safeguarding the welfare of society. The Act was revised pursuant to Act LXVII of 2021 (passed by the House of Representatives on 14 December 2021 – the Amending Act) to come in line with the Directive. In doing so, the Maltese legislature has been largely faithful to the text of the Directive. The amendments introduced by the Amending Act came into effect on 18 December 2021.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

The Act imposes an obligation to establish formal channels and procedures for internal reporting on every employer, as defined in the Second Schedule to the Act.

Previously, the list of subject-persons (ie, employers) was limited to a few entities within the private sector meeting at least two of the following criteria: more than 250 employees; a total balance sheet exceeding €43,000,000; and/or annual turnover exceeding €50,000,000.

In terms of the Act (as amended), the term “employer” now covers any entity within the private sector having 50 or more employees. This obligation may apply to entities with fewer than 50 employees where this is considered necessary following an appropriate assessment of the level of risk arising from their activities, such as those involved in environmental and public health.

The obligation to establish internal reporting channels and procedures also applies to entities falling within the scope of the Union acts referred to in Parts I(B) and II of the Annex to the Directive (applicable through a schedule to the Act), regardless of the number of employees. Examples include companies in the financial services sector and sectors susceptible to money laundering and terrorist financing.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

The obligation to establish internal reporting channels and procedures applies to every company with 50 or more employees, even when such companies belong to a group of companies. Notwithstanding this:

• the Act allows medium-sized entities employing between 50 and 249 persons to share resources concerning the receipt of reports and any investigation to be carried out; and
• maintaining or creating centralised whistleblowing functions within a group is not prohibited, provided that internal reporting channels and procedures are also available at the subsidiary level.

This is in line with guidance provided by the European Commission on the interpretation of the Directive.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

The Act does not provide for a specific sanction if a covered entity fails to establish internal reporting channels and procedures. That said, the importance of having channels and procedures to facilitate internal reporting cannot be overstated. This enables companies to address issues internally and minimise the risk that their reputation or interests are harmed by exposure to competent authorities or the public.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

There is no legal requirement (whether in the Act or local employment legislation) for an employer to inform or consult with employee representative bodies on its internal reporting channels and procedures.

Aside from the above, the Act recognises the right of employees to consult with their representatives or trade unions (without suffering any unjustified detrimental action for doing so), the autonomy of those social partners, and their right to conclude collective agreements, which remain unaffected by this Act.

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

The company must publish:

• clear and easily accessible information about the existence of the internal procedures; and
• adequate information on how the internal procedures may be used. This information is to be published widely and republished at regular intervals (the Act does not define any specific periods).

The company must also provide clear and easily accessible information regarding the procedures for reporting externally.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

In theory, the Directive states that the reporting channel may be operated internally or externally by a third party. The Act requires the employer to designate an officer from within the company (whistleblowing reporting officer – WRO), who may or not be the same person receiving reports, to follow up on reports.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

As part of his or her functions, the WRO is required to keep records of every report received. In doing so, the WRO must comply with the duty of confidentiality (ie, the WRO cannot reveal any information that identifies or may lead to the identification of the whistleblower, not even as ordered by a court, unless they have obtained the express consent of the whistleblower).

The WRO must also abide by the data-processing principles enshrined within Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data (the GDPR) and local data protection legislation. In particular, the employer must be able to justify each processing activity in respect of a whistleblowing process, while retaining only the personal data contained in the reports that is strictly necessary – the data minimisation principle. Accordingly, personal data that is clearly not relevant for the handling of a specific report must not be collected or, if accidentally collected, must be deleted immediately.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

When drafting a whistleblowing policy, employers should ensure that the whistleblowing procedure guarantees the impartial and confidential treatment of reports. It must also ensure that the whistleblowing procedure is operated securely and prevents access to reports by non-authorised staff members.

The obligation to adhere to the principle of data protection by design and default means that the whistleblowing procedure itself must be designed to be GDPR-compliant from the start. The employer would need to have a privacy notice that covers any processing of personal data carried out in connection with the whistleblowing procedure. Any processing of personal data carried out in the context of the obligation to establish a whistleblowing procedure under the Act must be documented to demonstrate compliance with the GDPR – the accountability principle.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

Broadly speaking, information on improper practices would be considered a protected disclosure and would fall within the scope of the Act. Such information (including reasonable suspicions) would relate to actual or potential improper practices that occurred or are very likely to occur in the organisation the whistleblower works in or has worked in, or one with which the whistleblower is or was in contact through their work, and about attempts to conceal such improper practices.

The list of improper practices provided by the Act includes:

• failure to comply with any applicable legal obligation;
• danger or risk thereof to the health or safety of any individual;
• damage or risk thereof to the environment;
• the occurrence or potential occurrence of any corrupt practice;
• the commission or potential commission of any criminal offence;
• miscarriages of justice;
• bribery;
• breaches of EU legislation that concern areas such as transport safety, consumer protection, protection of privacy and personal data, and security of network and information systems, among others;
• breaches affecting the financial interests of the EU; and
• breaches relating to the internal market (eg, breaches of competition and state aid rules).

Disclosure of information protected by legal and medical professional privilege is not a protected disclosure under the Act.

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

Sector-specific rules on reporting may be found in legislation relating to the financial services sector. Professionals or institutions carrying out a relevant activity or financial business may be subject to rules on reporting knowledge or suspicions of money laundering or the funding of terrorism.

Reports relating to the activities of persons operating within certain sectors are received and processed by the regulator, as set out in a schedule to the Act. For example:

• the Financial Intelligence Analysis Unit is the authority responsible for the receipt of reports from any employee of a natural or legal person, subject to the Prevention of Money Laundering Act (Chap. 373 of the laws of Malta – the PMLA) or the Prevention of Money Laundering and Funding of Terrorism Regulations (Subsidiary Legislation 373.01 – the PMLFTRs), of improper practices linked to the PMLA/PMLFTRs; and
• the Malta Financial Services Authority (the MFSA) is the authority in Malta responsible for the receipt of reports from any employee of a person or company that provides the business of credit and financial institutions, the business of insurance and the activities of insurance intermediaries, the provision of investment services and collective investment schemes, pensions and retirement funds, regulated markets, central securities depositories, the carrying out of trustee business either in a professional or a personal capacity, and any other areas of activity or services as may be under the supervisory and regulatory competence of the MFSA.

Where specific rules on the reporting of improper practices or breaches are provided for in sector-specific legislation, those laws will apply and the provisions of the Act will apply to the extent that a matter is not expressly regulated by that legislation.

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

The term “whistleblower” is defined as any employee (as defined in question 13 below) who makes a disclosure to the WRO, whether it qualifies as a protected disclosure or not. The prohibition of detrimental action and the disclosure of identifying information apply only with respect to a whistleblower who makes a protected disclosure under the Act.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

A whistleblower is an employee, who is (a) any person who has entered into or works under a contract of service with an employer, and includes a contractor or sub-contractor who performs work or supplies a service or undertakes to perform work or supply services, and (b) any person who has undertaken to execute any work or service for, and under the immediate direction and control of another person, including a remote worker, but excluding work or services performed by professionals bound by professional secrecy. It also extends to, inter alia:

• former workers;
• seconded workers;
• candidates for employment;
• shareholders and persons belonging to the administrative, management or supervisory body of the company; and
• trainees.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

It is understood that a whistleblower is a natural person who discloses information acquired in a work-related context. The requirements for a whistleblower to be protected under the Act are explained in question 22.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

The general rule under the Act is that anonymous disclosures are not protected disclosures (which are allowed by the Directive). However, if following a public disclosure that was made anonymously, the identity of the whistleblower is discovered and they suffer retaliation, that disclosure could be a protected disclosure if it satisfies the conditions established in the Act (please see question 22).

The WRO may receive and process any anonymous disclosures and may take them into account when determining whether an improper action has occurred.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

In principle, no. A disclosure by a whistleblower may be based on reasonable suspicion of potential improper practices and attempts to conceal such practices.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

Entities in the private sector are free to establish their own procedure, provided it complies with the minimum requirements in the Act.

To do so, reporting channels must enable persons to report in writing or orally (ie, by telephone or through other voice-messaging systems and, upon request by the whistleblower, through a physical meeting within a reasonable timeframe). The reporting channels must be designed and operated securely so that the identity of the whistleblower and any third party mentioned in the disclosure remains confidential and access must be limited to authorised staff members.

The employer must designate an impartial WRO, who is responsible for following up on reports received (including assessing the accuracy of the allegations made in a report and, where relevant, addressing the improper practice reported). The functions of the WRO include maintaining communication with the whistleblower, asking for further information from and providing feedback to the whistleblower as necessary, and keeping a record of every report.

There are also certain maximum applicable timeframes, namely:

• the receipt of all reports must be acknowledged within seven days; and
• the WRO must provide feedback to the whistleblower on the progress made in following up on the report within a reasonable time, which must not exceed three months from the acknowledgement of receipt.

In carrying out his or her functions, the WRO must comply with the GDPR and local data protection legislation. The Act also specifies how the record-keeping of an oral disclosure can be made.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

As a principle, whistleblowers are encouraged to first report to their employer through the internal reporting channels, where these are available and can reasonably be expected to work. As stated in the Directive, the idea is that the relevant information swiftly reaches those closest to the source of the problem and most able to investigate and with powers to remedy it, where possible. In certain circumstances, a whistleblower can disclose information to a competent authority or the public (please see question 22).

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

The investigation of whistleblowing cases is handled internally but if an internal disclosure leads to the detection of improper practices that constitute a crime or contravention under any applicable law, the WRO may refer the report to the police for investigation. However, the WRO is not legally obliged to do so if the subject of the report received has been rectified.

There are only specific crimes (namely, crimes against the safety of the government) that, under Maltese law, an individual must report to the authorities if he or she becomes aware that they are about to be committed.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

The Act protects the whistleblower even if they are mistaken on the import of the information disclosed, provided the disclosure was made in good faith and was based on a reasonable suspicion.

The protections afforded under the Act do not apply to an employee who knowingly discloses information they know or ought to reasonably know is false. The Act further allows any person or company (excluding the employer or officers or shareholders of the same, in the case of a company) prejudiced by the disclosure of such false information to pursue any legal action or remedy available under any other law in respect of such prejudice, provided that the identity of the whistleblower has been obtained or otherwise revealed under the provisions of the Act.

Providing false information is also an offence that can lead to imprisonment under article 101 of the Criminal Code (Chapter 9 of the laws of Malta).

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

The Act provides for penalties applicable to any person who tries to compel any other person to abstain from doing any act that the other person has a right to do under the Act, wrongfully and without legal authority, through the following acts:

• using (or threatening to use) violence against the person, their family members or property;
• persistently following the person from place to place;
• watching or approaching the person’s home; or
• depriving the person or somehow hindering them in the use of any of their belongings.

Such conduct is an offence and is punishable by imprisonment for up to one year or a fine of not less than €500 and not more than €5,000. Where as a result of his or her conduct the person convicted has achieved his or her aim, imprisonment will increase by one or two degrees and the fine can range from €1,500 to €10,000.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

A whistleblower is entitled to protection when making a protected disclosure, defined as an internal disclosure, an external disclosure, or public disclosure of information made under the applicable provisions of the Act. The Act protects a whistleblower acting in good faith, who has reasonable grounds to believe that the information on improper practices is true at the time of the disclosure and that such information falls within the scope of the Act.

An internal disclosure must be made in the manner set out by the whistleblowing procedure established by the employer. However, an employee may – (i) in the absence of a whistleblowing procedure or (ii) if they have reasonable grounds to believe that the WRO is not the appropriate person to whom the disclosure may be made – speak to the head or deputy head of the company, who shall be deemed to be the WRO. By way of clarification on (ii), this will be the case where the WRO is or may be involved in the alleged improper practice; or the WRO is related to or associated with a person who is or may be involved in the alleged improper practice.

An external disclosure will only be protected if the employee has made or attempted to make an internal disclosure first. Alternatively, an employee can make an external disclosure directly to the whistleblowing reports unit of the competent authority:

• where they have reasonable grounds to believe that the head or deputy head of the company is or may be involved in the alleged improper practice;
• where justified because of the urgency of the matter or other exceptional circumstances;
• where they will be subjected to an occupational detriment by the company if they make an internal disclosure;
• where it is likely that evidence relating to the improper practice will be concealed or destroyed if they make an internal disclosure; or
• where, notwithstanding an internal disclosure, they have not been updated on the status of the matter or it is reasonably evident that nothing was done on the matter.

The entities prescribed to receive external disclosures are listed in a schedule to the Act. In considering whether to disclose information externally, an employee should be guided by the factors listed in article 16(2) of the Act.

Where, despite having gone through the process of internal and external disclosure, no appropriate remedial action is taken within the dictated timeframes, the employee can resort to public disclosure. This is further restricted to the situations specified in article 18A of the Act, such as where there is an imminent or manifest danger to the public interest.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

The Act prohibits subjecting a whistleblower to detrimental action after they have made a protected disclosure. The term “detrimental action” includes action causing injury, loss or damage, victimisation, intimidation or harassment, or professional detriment such as dismissal, suspension or demotion, if connected with a disclosure. Additionally, a whistleblower who makes a protected disclosure is not liable for judicial or disciplinary proceedings. This does not apply if the whistleblower was the perpetrator or an accomplice in the improper practice reported, and it constitutes a crime or contravention under any applicable law. Even in this case, the whistleblower may benefit from a limitation of liability, mitigation or exemption of punishment; however, this is a decision left to the court hearing the case against the whistleblower.

The protection afforded to a whistleblower also extends to a facilitator, a person who assists the whistleblower in the reporting process. Third persons (eg, colleagues or relatives) as well as any legal entities the whistleblower owns, works for or is otherwise connected with in a work-related context are (where relevant) likewise protected.

The identity of the whistleblower cannot be revealed, not even under a court order, unless the whistleblower gives express consent. While the Directive allows the disclosure of the identity of the whistleblower where this is a necessary and proportionate obligation under Union or national law, the Act states that this protection “shall not be subject to any exceptions” (article 6(4)).

The Act also provides for the legal action a whistleblower may take if they believe that they have been or will be discriminated against because of a protected disclosure. The whistleblower may ask the court for an order requiring the employer to remedy the discrimination and award compensation, or take any action the court considers appropriate. The court may also grant interim relief.

Furthermore, the rights and remedies provided for in the Act cannot be waived or limited by any agreement between an employer and an employee. Any provision intended to prevent the creation or continuation of any proceedings under the Act or any proceedings for breach of contract, or which has the effect of discouraging the employee from making a protected disclosure, will be void in terms of the Act.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

In addition to the protection mentioned in the reply to the preceding question, the Act provides that the following support measures are available to the whistleblower:

• comprehensive and independent information and advice, easily accessible to the public and free of charge, on the procedures and remedies available, on protection against discrimination, and on the rights of the accused;
• effective assistance from competent authorities involved in their protection; and
• legal aid in criminal and cross-border civil proceedings under Directive (EU) 2016/1919 and Directive 2008/52/EC.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

A whistleblower who knowingly discloses false information is not protected under the Act and is guilty of a criminal offence, as explained in question 20.

A whistleblower who does not comply with the procedure (as outlined in question 22) will not benefit from the protection afforded by the Act.