Comment

The uncertain legal situation that whistleblowers have been exposed to in the past is intended to be ended by the Whistleblower Protection Act. It came into force on July 2, 2023 and lists mandatory reporting points to be set up. Whistleblowers can contact them to report violations of the law by companies. The risk of committing a criminal offense or being prosecuted under labor law by passing on such information under the Law on the Protection of Trade Secrets, which came into force in 2019, has therefore been significantly reduced. These internal and official external reporting offices, which have been set up by companies since July 2nd and December 17th, 2023, must treat all information confidentially, check it for relevance and only then take any necessary measures (for details of the law see: Sander, " The Whistleblower Protection Act - Information on implementation in pharmaceutical companies", PharmInd, issue 9/2023).

To maintain confidentiality, certain reporting channels must be set up. These must ensure that only the responsible person who is sworn to secrecy has access to reports. This means that only the person specified as the addressee receives the information, for example via an email address that is only accessible to them. This is particularly important for “internal reporting points” that are set up within the company. But even with the “internal reporting points” provided as services for certain companies, for example by law firms, the circle of recipients should be kept as small as possible and preferably limited to the lawyer entrusted with them (see, for example, the homepage of the Sander & Krüger law firm). .

This must also apply to the “external reporting office”, which is set up by the federal government at a higher federal authority assigned to the Federal Ministry of Justice, the Federal Office of Justice (BfJ). The BfJ has already published instructions on its homepage with the following wording (excerpt):

“The external reporting office of the federal government - regardless of whether it is responsible for the incoming report - must maintain the confidentiality of the identity of the following persons:

1. the reporting person, provided that the reported information relates to violations that fall within the scope of application of the Whistleblower Protection Act, or the reporting person had sufficient reason to believe that this was the case at the time of the report,

2. the persons who are the subject of a report, d. H. all persons who are affected by a report, and

3. the other persons named in the report. This involves those involved or uninvolved third parties, who can be, for example, colleagues, superiors or even employers themselves. These third parties may have observed violations or may otherwise be affected by the report. Since these third parties may play an important role in further proceedings, their identity must also be largely protected.

The identity of these persons may only be known to those responsible for receiving reports or taking follow-up actions and those assisting them in carrying out these tasks. This protection includes maintaining the confidentiality of identity for all affected persons equally at every stage of the procedure. It includes not only the identity of the data subjects themselves, but also all other information from which the identity of these persons can be derived.

Additional external reporting offices can be set up by the federal states and must be set up by the Federal Office for Financial Supervision and the Federal Cartel Office.

Under these new legal and organizational frameworks, reports of violations of the law by and within companies are likely to occur more frequently than before. This is intended by the legislature, since grievances in companies (often occurring only after years) have serious consequences for the companies affected (see emissions scandal due to inadmissible shutdown devices, which were intended to ensure that emissions control only works on the test bench) and the consumer public (see Breast implant scandal due to inferior breast implants).

The German whistleblower protection law was preceded by various international and European initiatives, such as the “United Nations Convention against Corruption” of October 31, 2003 and the EU directive on whistleblower protection (Directive (EU) 2019/1937 - “EU Whistleblower Protection Directive "), which came into force on December 16, 2016. The latter has now been implemented into German law.

Author's address:

Lawyers Dr. Axel Sander and Dr. Matthias Runge

Sander & Krüger Rechtsanwälte PartG mbB

Mainzer Landstrasse 55

60329 Frankfurt am Main