Goethe already knew, "Good is the resolution, but the fulfillment is difficult." This does not seem to have changed over the centuries. According to Statista (Statista survey 2019), only one in five do not break their good resolutions for the next year. For the vast majority, good intentions last only a few hours (3 percent of respondents) to - at least - two months (27 percent of respondents). Sobering figures. The implementation of the EU Whistleblower Directive by German lawmakers shows that "procrastination" is not a purely private phenomenon. With a delay of more than a year, implementation is now on the legislature's agenda and the requirements of the Hinweisgeberschutzgesetz (HinSchG) are expected to be mandatory for companies with 250 or more employees in early summer of this year. However, companies with 50 or more employees also only have until the end of the year to implement.

The law was passed by the Bundestag on December 16 and will probably also be confirmed by the Bundesrat on February 10. After that, the deadline of three months for implementation will run. The end of the deadline does not have to be the start of the establishment of the internal reporting office, but it must be up and running.

Even if the entry into force of the HinSchG is still a bit delayed, companies should already start dealing with the requirements now. Contrary to many advertisements for IT-supported whistleblower protection systems, implementation requires more than just setting up the communication channels. In co-determined companies, however, advance preparation is also necessary. The works council must be involved and a company agreement may have to be concluded.

But even without a works council, numerous personnel and organizational points must be taken into account. For example, an existing code of conduct must be adapted or written. The HinSchG attaches great importance to confidentiality and protecting the identity of the whistleblower. Therefore, an authorization concept should ensure that only the employees entrusted with the reporting office have access to the data.

The selection of these employees should also be well thought out. According to the law, they should be independent and free of conflicts of interest. It is also important to keep an eye on the risks under employment law. These arise in particular from the ban on reprisals against whistleblowers and the associated reversal of the burden of proof. Companies must prove that the whistleblowing and the labor law measures were considered completely separately from each other. The supposedly most obvious location of the reporting office in the HR department therefore often makes less sense.

Once the employees have been found, they will probably still have to be trained. The law explicitly requires the necessary expertise for this. In addition to knowledge of the requirements of the law, general compliance and legal understanding should also be relevant here alongside the DSGVO principles. External service providers / certifiers can be used for this purpose, for example.

Last but not least, the consistent communication of the establishment and purpose of the internal reporting office among the staff should not be neglected. To this end, it is advisable to first consider the employee structure and their access to corporate information (e.g., intranet, bulletin board) in order to ensure that the target group is addressed appropriately. An essential instrument should always be the "tone from the top", i.e. the communication of the company management. In particular, this should give employees confidence in the internal reporting office and thus ensure that they prefer the internal to the external reporting office if they suspect a violation of the law. In this way, whistleblower protection then also becomes corporate protection, since the facts can be clarified without, for example, damage to the company's reputation already having occurred.

The external assignment of the internal reporting office offers assistance or completion of many of the aforementioned necessary measures. Here, the legislator explicitly allows the entrustment of a third party. Due to their expertise and legal status, law firms are particularly suitable as operators of the internal reporting office.

For further information, please contact:

Kristin Peitz
Head of Compliance Services
kristin.peitz@ksp.de
+49 40 450 65 1553

Go back