The European Commission has initiated an infringement procedure against Germany and 23 other Member States for failure to implement the EU Whistleblower Directive. Said Directive has been on the EU agenda since 2019 and should have been transposed into national law in all Member States by 17 December 2021. A planned German Whistleblower Protection Act failed during the last legislative period due to disagreement. The current governing parties in Germany have announced the implementation of the Directive in their coalition agreement; however, an updated or new draft has not yet been presented. What does this mean for employers?
In October 2019, the European Union adopted Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law. The Member States were obliged to transpose the provisions of the Directive into national law by 17 December 2021. To this end, the German Federal Ministry of Justice prepared a draft for a German Whistleblower Protection Act. According to that draft, in particular all companies in the financial services industry would be required to establish an internal and/or external whistleblowing system for reporting breaches of national or EU law by the company. This would apply irrespective of the number of people employed. All further companies with a workforce of 50 or more would also be required to establish an internal and/or external whistleblowing system. Companies with a workforce of 50 to 249 would be allowed more time, until 17 December 2023, to establish a system. The draft provides for two equivalent types of reporting channels, internal and external ones, among which the whistleblowers could choose freely. The internal whistleblower system would have to meet certain minimum requirements. Reporting persons would be comprehensively protected against retaliation, such as dismissal or other detriment, provided they complied with the requirements for a report or public disclosure. In the event of a dispute, it would be for the company to prove that a measure taken by the company against the whistleblower was not taken in retaliation for the report or public disclosure (reversal of the burden of proof).
The planned German Whistleblower Protection Act did not come into existence during the last legislative period because of disagreement within the governing coalition. The draft that had been prepared by the German Federal Ministry of Justice failed in the interdepartmental consultation process among the federal ministries involved in April 2021. The proposed law was intended not only to implement the provisions of the EU Whistleblower Directive but also to expand them in part: for example, not only breaches of EU law but also breaches of German law were intended to be covered. Critical voices claimed that an expansion of protection would increase the cost and effort involved in implementation, pointing out that the German economy was already struggling to cope with the economic consequences of the COVID-19 pandemic. Those in favour of the expansion argued that this would help avoid different levels of protection for reporting breaches of national law on the one hand and breaches of EU law on the other hand.
The current governing parties will have to revive the legislative process. The coalition agreement contains the following provisions in this regard: “We will implement the EU Whistleblower Directive in a legally compliant and practicable manner. Whistleblowers must be protected against legal detriment not only when reporting breaches of EU law, but also when reporting significant breaches of laws and regulations or other serious misconduct whose disclosure is of particular public interest. We want to improve the enforceability of retaliation claims against the injuring party and, to this end, are looking into counselling and financial support schemes.” According to the above, the upcoming German Whistleblower Protection Act will cover both breaches of German law and the disclosure of serious instances of maladministration, abuse or other grievances.
Upon expiry of the time allowed for transposition into national law, EU Directives can have direct effect even without a national implementation act. This is particularly the case where the relevant provisions are clear and unambiguous enough for there to be no need for further specification in national law. If these requirements are met, the EU Directive can in any case be considered to be directly applicable between citizen and government.
Whether it is also directly applicable between a private employer and a private employee is a controversial question. There are, however, good arguments against such a direct effect between private employers and employees. It can therefore be assumed that whistleblowers cannot directly rely on the EU Directive in such a private legal relationship.
On 27 January 2022, the EU Commission already sent letters of formal notice to the Member States concerned, giving them an ultimatum to incorporate the provisions of the Whistleblower Directive into national law. If this request is not complied with, the Commission can refer the case to the European Court of Justice (ECJ), who may then impose sanctions, where appropriate.
As a draft bill is likely to be forthcoming in the near future, there is a need for concrete action on the part of employers. Employers would be well-advised to develop and implement suitable reporting systems that meet the requirements set out in the EU Directive. Even if one assumed, contrary to the above, that the Directive were directly applicable, employers could thus counter the liability risk until the entry into force of the German Whistleblower Protection Act.
Employers should especially make sure that they observe the legal rules on co-determination by the works council in the process. In addition to the co-determination right under Section 87 (1) no. 1 German Works Constitution Act, also that under Section 87 (1) no. 6 German Works Constitution Act needs to be taken into account where plans exist to establish an electronic system for reporting breaches of the Directive.