The Whistleblower Directive (EU) 2019/1937

The aim of the Directive is to protect from reprisals those persons who lawfully report whistleblowing information of violations of important provisions of EU law. To this end, the Directive requires companies of 50 employees or more to provide whistleblowers with internal and external channels for reporting certain violations of law.

Current legislative process in Germany. The Whistleblower Directive was enacted in 2019 and should have been transposed into national law by the Member States by 17 December 2021, which only Sweden and Denmark managed to do.

In Germany, no implementation has taken place to date. In November 2020, the Ministry of Justice prepared a draft bill, which, however, did not gain entry into the legislative process due to a lack of political agreement. A draft bill for the Whistleblower Protection Act has finally been available since summer 2021. The Bundesrat decided to issue a statement on this in its 1024th session on 16.9.2022. Based on the resolution recommendation and the report of its Legal Affairs Committee, the German Bundestag decided on Dec. 16, 2022, to adopt the bill in its amended version. However, during the legislative vote in the 1030th session of the Bundesrat on Feb. 10, 2023, the Bundestag resolution on protection against so-called whistleblowers ultimately did not gain approval. This means that the law cannot enter into force as planned. The Bundestag and Bundesrat now have the option of appealing to the Mediation Committee to reach a compromise with the states. The further progress of implementation into national law therefore remains to be seen.

The main criticism of the draft law is that it regulates significantly more than required by the directive. The material scope of application is an enormous extension of the requirements of European law, and it imposes an unnecessarily high bureaucratic burden on companies.

Application of the Directive. In principle, a directive can also be applied directly until it is finally transposed into national law. This direct effect only applies to the state and not to private individuals. In individual cases, the direct effect of a directive is to be determined on the basis of the respective provisions in the specific directive. If the directive is unconditional and sufficiently precise, it can be applied directly. However, if it contains an obligation for private individuals, direct application of the directive is not possible. Thus, until the implementation of the Whistleblower Directive, no employee can invoke the Directive against his employer.

Initial Situation of the Directive. According to Art. 2 WFD, the Whistleblower Directive regulates topics in the areas of financial services, product safety, traffic safety, environmental protection, radiation protection, food safety, public health, consumer and data protection as well as public procurement, for which the material scope of protection is opened.  Art. 4 of the Directive regulates the personal scope of protection for employees and civil servants from current, future and past employment relationships as well as trainees and shareholders or persons who belong to administrative, management or supervisory bodies. In addition, relatives and other third parties who are in contact with the whistleblower and may be at risk of professional reprisals as a result of a whistleblower are protected. The annex to the directive contains an explicit nine-page list of which reports of infringements of legal acts are covered by the directive.

According to Article 8 (1), (3) of the WFD, Member States must ensure that legal persons in the private sector with more than 50 employees have procedures in place to report information on infringements or violations of certain provisions of Union law. According to Article 8 (2) in conjunction with Article 4 (1) (b), (c), (d), (2) of the WFD, this protection may be extended to other categories of persons, such as shareholders, members of governing bodies or persons working under the supervision and management of business partners.

For municipalities and legal entities under public law, the same obligation to establish reports exists according to Art. 8, Para. 9 WFD, however, regardless of the number of employees. However, municipalities with less than 10,000 inhabitants or less than 50 employees can be exempted from this obligation.

According to Art. 8 (5) WFD, companies have the choice of setting up reporting channels through internal company departments or through external bodies. Companies with up to a maximum of 249 employees may, according to Art. 8 Para. 6 WFD, alternatively also set up a sharing of resources while maintaining confidentiality.

Practical Implementation of the Requirements. Whether and how the requirements of Art. 8 of the Directive can be met in practical implementation is not further elaborated by the Directive, so that this question is circulating in corporate practice. Particularly from a financial and logistical point of view, the question arises as to whether several parts of a company that are obliged to set up a whistleblowing system can set up a joint central system operated by the parent company. Financially, this could ease the burden, as only one whistleblower system needs to be operated. In addition, a central system makes it easier for the parent company to identify indications of recurring violations in the parts of the Group. In particular, it is questionable whether the possibility of sharing resources for companies with up to 249 employees through Art. 8 (6) WFD results in a privileging of legal entities in the private sector with a number of employees between 50 and 249.

Opinions in the literature differ regarding the establishment of a centralized uniform whistleblowing system by the parent company. One view draws the reverse conclusion from the wording of Art. 8 Para. 6 Sentence 1 that corporate groups with 250 or more employees in one part of the company must provide their own reporting system or outsource it to external parties. Accordingly, resources can only be shared by a group-wide system up to a total company size of 249 employees in all parts of the company (cf. Federmann/Racky/Kalb/Modrzyk).

Another view interprets the wording to mean that if only the parent company or an individual group company has reached the number of employees of 250, a joint reporting office may nevertheless be set up, provided that this is done at the parent company in compliance with confidentiality and independence standards by providing an impartial person (Gedermann/ Spindler).

According to another opinion, Art. 8 (5) sentence 1 WFD is read to the effect that other companies of a corporate group may also act as external third parties. The only thing to note is that the reporting systems must be organizationally separate (Forst).

The broadest view in the literature requires only an intra-group transfer to other legal entities or to third parties possible, which only have to comply with the procedural standards laid down in Art. 9 (2) WFD (Schmolke).

At the request of several companies and associations, the European Commission has made its restrictive position clear. Although a group company can be a third party to another group company within the meaning of Art. 8 (5) WFD, the possibility of providing information is limited to the receipt and confirmation of the receipt of information. The subsequent examination and taking of measures must then be carried out by the individual group companies, provided that they have reached 250 employees.

Practical implementation. Regardless of which view is followed in the literature, the opinions assume an interplay of Art. 8 Para. 5 and Para. 6 WFD in. In principle, any legal entity can fulfill its establishment obligation by outsourcing the whistleblowing system. In addition, it should be permissible to set up a joint whistleblower system for the entire company. Up to 249 employees, a sharing of resources can indisputably take place. If, on the other hand, the company is larger, the reporting channels of the corporate groups must be separated. Although the parent company can set up a whistleblower system, the individual companies must be separated, each with its own reporting channel with its own telephone number and e-mail address, which is protected from the other reporting channels. The current draft law on the implementation of the Directive also does not specify the obligation to set up a uniform whistleblower system. Accordingly, it remains to be seen whether more clarity will be created in the future legal formulation for the establishment of whistleblower systems.