The Whistleblower Protection Act (HinSchG) represents the German implementation of the EU Whistleblower Directive, which for the first time aims to establish standardised protection for whistleblowers throughout the EU. The law regulates the protection of natural persons who have obtained information about violations in the course of their professional activities and pass it on to internal or external reporting bodies (so-called whistleblowers). The Whistleblower Protection Act prohibits any reprisals or retaliation against whistleblowers.

In addition, the law is also intended to create opportunities for companies by establishing internal reporting systems. This is because such indications can be understood as an early warning system that enables companies to check this information and react to it before the public learns of the grievances.

On 13 April 2022, the Federal Ministry of Justice published its draft bill for a "Law for Better Protection of Whistleblowers and for the Implementation of the Directive on the Protection of Persons Reporting Breaches of Union Law" (Whistleblower Protection Act, hereinafter HinSchG-E). The draft is long overdue, as the implementation deadline of the Directive has already expired on 17 December 2021.

• Optimising the enforcement of Union law by setting common minimum standards
• Exposure of grievances/violations
• Facilitation of the notification process
• Strengthening the protection of whistleblowers
• Creation of an independent response option for companies/authorities

Since December 17, 2021 , companies with 250 or more employees or annual sales of more than 10 million euros have had to provide secure internal reporting channels, e.g. a whistleblower system. Likewise, public institutions, authorities as well as municipalities with a population of 10,000 or more must introduce whistleblower systems. With regard to companies with 50 - 249 employees, a grace period remains until 17.12.23.

According to the Whistleblower Protection Act, reporting channels means a whistleblower system that enables a whistleblower to submit a report confidentially. Confidentiality does not mean anonymous, but that the confidentiality of the identity of the whistleblower and third parties mentioned in his or her report is maintained.

The draft of the German Whistleblower Protection Act (HinSchG-E) initially includes all persons who have obtained information about violations in their professional environment. Accordingly, whistleblowers can be any person who notices and reports a violation in the course of their professional activity, e.g.: Employees, applicants, civil servants, self-employed persons, interns, former employees, etc.

The internal reporting office may also be available to other natural persons (e.g. suppliers, customers or their employees),
Section 16 (1) sentence 2 HinSchG-E.

Whistleblowers are protected under the following conditions:

There is reasonable cause to believe that the information on a breach is true and falls within the scope of the Directive and that the reporting channels provided will be used.

All reports and disclosures of violations that are punishable by law:

• Violations subject to fines "to the extent that the violated provision serves to protect life, limb or health or to protect the rights of employees or their representative bodies."
• In contrast to the EU Whistleblower Directive, not only the disclosure of violations of EU law, but also of certain areas of German law
• for example, cases in which corruption, money laundering or tax fraud are uncovered, or violations of environmental protection or food safety requirements.

The newly created provisions on fines standardised in Section 40 (2) HinSchG-E go beyond the European HinSch-RL. A fine of up to EUR 100,000 will be imposed on anyone who prevents (or attempts to prevent) a report or subsequent communication, anyone who takes (or attempts to take) prohibited reprisals or anyone who intentionally or negligently disregards the confidentiality requirement.

Furthermore, unlike the HinSch-RL, the draft bill also provides for a fine of up to EUR 20,000 for the non-establishment and non-operation of an internal reporting system.