Whistleblowing reporting models

The Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 about the protection of whistleblowers in Union law updates issues related to whistleblowing reporting models.

The existing whistleblowing models are - at least in Germany - based on legal norms and case law from the time before the adoption of the Directive and the (twice) work on its implementation. For these reasons, it is worth taking a look at them. Of minor importance is the fact that the Directive refers to the reporting of infringements of certain acts explicitly listed in the Annex to the Directive. In addition, its scope of application does not overlap with the legislation under which the systems already in place (the material scope of the Directive concerns public procurement, services public procurement, services, products and financial markets, as well as the prevention of money laundering and terrorist financing, product safety and conformity, transport safety, environmental protection, radiological and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, privacy and personal data, and security of networks and information systems).

It is much more important to emphasise that the German reporting models developed within the framework of existing legislation fulfil the requirements of Articles 8 and 9 of the Directive. This also applies to system solutions offered on the market by third parties (which will be discussed further below).

The only significant innovation that results from the Directive for companies under German law is the obligation to set up such systems for more than 50 employees. Germany as well as Poland, Estonia, Spain, Luxembourg, Italy and Finland have not yet enacted any national legislation to implement the Directive. In any case, all Member States - with the exception of Denmark and Sweden, which have transposed the Directive by the deadline of 17 December 2021. - have failed to transpose it.

Work on the German draft of the transposition law has not yet been completed. On 16.12.2022, the Bundestag passed the government draft of a Whistleblower Protection Act as amended by the Legal Affairs Committee. However, the Bundesrat did not approve the draft in its 1030th session on 10.02.2023, which means that the Bundestag or Bundesrat can now call on the mediation committee. 

The work on the Polish draft law on the protection of whistleblowers has also not yet been completed. According to the website of the Centre for Government Legislation, the Committee on European Affairs has not finalised the draft bill on the Protection of Whistleblowers Bill (UC101), with the concurring observations of the Minister for European Union Affairs, the Minister of the Interior and Administration and the Minister of Finance with a protocol of deviation, in which the remarks of the Minister of Justice, the Minister of Foreign Affairs, the President of the Office of Competition and Consumer Protection and the President of the Centre for Government Legislation in agreement with the position of the Minister for Family and Social Policy. The Committee recommended to the Standing Committee of the Council of Ministers to consider the Bill together with the Protocol of Deviation. The bill is expected to be passed in April this year.

What has influenced the development of reporting models?

Regulations at the level of European law are of no small importance for the practice of developing reporting systems for violations in Germany. I am thinking here above all of Article 32

of Regulation (EU) No. 596/2014 of the European Parliament and of the Council of 16 April 2014 on Market Abuse and repealing Directive 2003/6/EC of the European Parliament and of the Council and Directives 2003/124/EC, 2003/125/EC and 2004/72/EC of the Commission.

Attention should also be drawn to other legal institutions in Germany that may have whistleblowing regulations. For example, § 67 of the Bundesbeamtengesetz (Federal Civil Servants Act) of 5 February 2009, which provides for the duty to report suspected corruption or the justification for and protection against the negative consequences of reporting to the supervisory authorities in the event of non-compliance with occupational health and safety conditions by an employer, through a complaint by an employee, provided for in section 17 of the Act on the Implementation of the EC Framework Directive on Occupational Safety and Health and other Occupational Safety and Health Directives of 7 August 1996.

Reference should also be made to § 25a of the German Banking Act of 10 July 1961, which requires the establishment of a whistleblower system from 1 January 2014 on. In addition, reference should be made to the General Equal Treatment Act of 14 August 2006, which obliges the parties to collective bargaining agreements, employers, employees and their representatives to cooperate in achieving the objectives of the Act, and Section 27, which provides for the right to appeal to federal authority in cases of discrimination.

Two types of signalling systems

All these rules, which predate the Whistleblower Directive, became the basis for two types of whistleblowing systems. The Internal Whistleblowing System and the External Whistleblowing System.

Internal whistleblowing systems

Internal whistleblowing systems provide for irregularities to be reported to an internal body that is established for the purpose of investigating irregularities or has a status

that ensures an appropriate response to reported irregularities. This may be, for example, the works council or the personnel office. In addition, the systems usually involve third parties who are active in the field of public trust.

However, modern external systems are primarily based on information technology. This is not a trivial system for sending messages to an e-mail box, but a communication system that allows for anonymity and does not require any additional steps such as setting up an e-mail account. These systems offer the possibility to precisely identify the nature or the subject matter of the infringement. Especially large, cross-border companies have set up such systems. Their reporting systems cover all locations, whereby the verification of the reports often takes place at a central point.