Protected individuals

The aim of the law is to protect individuals who report breaches from dismissal, mobbing or other retaliation. As in the Directive, protected individuals include

• employees of private or public companies,

• civil servants,

• interns, volunteers, shareholders,

• persons whose employment relationship has ended or who are still in the process of negotiating an employment contract, and

• external contractors and suppliers.

Material scope

The material scope of the German draft bill goes beyond the requirements of the Directive. The material scope of the Directive is limited to reports of suspected violations of EU law. The German draft bill in addition covers any reports of suspected criminal offenses and suspected administrative offenses that protect the life, limb or health or rights of employees or their representative bodies.

Internal and external reporting channels

The draft bill would oblige all legal entities in the private sector with at least 50 workers to set up internal reporting channels as follows:

• The reporting channels must ensure confidential reporting.

• An anonymous reporting option is not mandatory.

• Companies have to enable written or oral reporting and make physical meetings possible.

• The persons responsible for the reporting channel must have a certain level of expertise and must be able to act independently. The draft bill explicitly states that the persons can still hold other functions as long as no conflicts of interests occur.

• Companies may commission third parties, such as law firms, to operate the internal reporting channels.

If a company does not set up an internal reporting channel, it could be sanctioned with a fine of up to EUR 20,000.00.

According to the draft bill, reporters shall be able to freely choose to report a suspected breach

• internally within their company or

• externally to the Federal Office of Justice or, in appropriate cases, to the Federal Financial Supervisory Authority or the Federal Cartel Office.

However, reporters shall be allowed to disclose their information to the public, for example to the media, only if

• they first made an report through the external reporting channel and no appropriate follow-up measures were taken or they did not receive any feedback on the implementation of such measures, or

• they had sufficient reason to believe that

  • the violation poses a direct or obvious threat to the public interest (e.g., because there is a risk of irreversible damage), or

  • in the case of an external report they would face retaliation, or

  • the implementation of effective follow-up measures is unlikely (e.g., because evidence could be suppressed).

Companies shall be required to provide clear information about the possibility to use external channels.

Anti-retaliation

In line with the Directive, the draft bill stipulates that reporters must not suffer retaliation for reporting in good faith. Going beyond the Directive, the draft bill also stipulates that reporters have a claim for damages against the company in case they suffer retaliation.

Group Privilege

In summer 2021, the EU Commission expressed an opinion that group wide reporting systems do not satisfy the requirements of the Directive. Instead, according to this interpretation of the EU Commission, each subsidiary of a group with more than 50 employees shall in principle be required to maintain reporting systems and investigation units.

The German draft bill and its explanatory material instead stipulate that in a corporate group, it is sufficient to have a reporting and investigation office at the parent company. The materials state that the subsidiary “remains ultimately responsible” for remedying the breach. However, this would not prevent the subsidiary from using group capacities. Thus, the German draft bill would provide a higher level of flexibility to corporates.