Germany: New EU directive aimed at improving the protection of whistleblowers aggravates obligations of local companies

As whistleblowers played a significant role in uncovering cases of corporate or governmental misconduct in the past, but often faced serious reprisals as a consequence, the EU wants to establish a higher level of protection for them.

In light of this, the EU-Council formally adopted a new directive on 7 October 2019 aimed at ensuring a higher level of protection for whistleblowers. According to the new regulations, public and private organisations, as well as public authorities in the member states, will be obliged to set up secure channels for the reporting of misconduct. Additionally, whistleblowers shall be widely protected from reprisals such as  suspension, downgrading or intimidation and shall have access to certain supporting measures.

The new directive on whistleblower protection will be published in the Official Journal after being formally signed. As EU directives do not directly apply in the member states, the member states will have to implement the regulations into national law within the next two years. However, local companies can already prepare themselves for the anticipated changes.

The new directive on the protection of whistleblowers essentially includes the following obligations for companies in the member states:

• Companies with more than 50 employees or an annual revenue of more than 10 million Euros will be obliged to set up internal, reliable reporting channels for whistleblowers. Whistleblowers shall have the option of submitting reports either in writing through an online platform, a mailbox or postal mail or orally through a telephone hotline or answering machine. A personal meeting shall take place at the request of the whistleblower. The whistleblower’s privacy must be protected regardless of the chosen way of reporting.
• Companies must inform their employees, as well as suppliers, service partners and business partners about the internal reporting process and alternative reporting options to the competent authorities. Such information must be easily accessible and understandable.
• The “best suited” person within the company shall be appointed for receiving and following up on the reports. Pursuant to the EU, such person can be a compliance officer, head of personnel, legal counsel, CFO or a member of the board or management. However, it is also possible to appoint an external person for this purpose.
• Whistleblowers are advised to first use their organisation’s internal channels before resorting to external channels set up by authorities. However, even if whistleblowers choose to contact external parties in the first place, they will retain their protection under the directive.
• The company must confirm to the whistleblower within seven days that his report was received. Furthermore, the whistleblower must be informed about taken measures as well as about the status of the internal investigation and its results.
• All reports received must be stored safely for the purpose of evidence. The EU and local data protection regulations must be observed.

It remains to be seen how exactly the EU directive will be implemented in Germany.