Powerless against whistleblowers?

Increased public debates surrounding whistleblower cases have repeatedly placed the phenomenon of whistleblowing on the political agenda in the past. The tone in debates and legislative amendments, such as the Money Laundering Act, is unequivocally: whistleblowers are entitled to protection from retaliation (XY 376/2014 2013/54). The so-called EU Whistleblower Directive is the most current and important impetus with which legislation continues this trend. Adopted in November 2019, it obliges companies with more than 50 employees, among others, to set up a whistleblowing system. The directive focuses on EU-wide protection rules for whistleblowers and the promotion of appropriate reporting of incidents in order to strengthen Union law in a comprehensive sense. Therefore, quite a few managing directors will be asking themselves: What legal means do I have as an entrepreneur in the event of whistleblowing?

Protection for whistleblowers

Indeed, the EU directive gives the impression that funds are limited on the company's part. It precisely defines which groups of people are entitled to protection. Thus, it's not just your employees, but also, for example, customers, suppliers, and shareholders who are included in the scope of protection in Article 4 of the directive. Even whistleblowers' supporters and family members should, in principle, be entitled to protection (Art. 4(3)(a), (b)). In general terms, it covers all persons who have obtained information about infringements of applicable EU law in a work-related context. This means that even individuals whom you have contracted but whose first day of work is still pending will obtain protection.

Furthermore, the directive specifically describes the scope of protection by stipulating which forms of retaliation are prohibited. This also results in comprehensive protection. Dismissal or suspension, as is often associated, is only one of fifteen defined forms of „retaliation“. Furthermore, pay reductions, workplace transfers, negative employee reviews, or the refusal of employee training are also considered retaliation, which the employer must prevent for the whistleblower (Art. 19 lit. a-o). What is special is that protection against these and other forms of retaliation, such as psychological harm, is by no means limited to your employees.

Powerlessness against protection claims?

So, what can be done about this seemingly impenetrable bastion protecting whistleblowers? The following details where the directive falls short and how employers can position themselves with measures to minimise their risk of legal disputes and potential damages payments. While these measures are proactive, we will subsequently explain what reactive legal remedies are available to you.

The EU directive not only establishes protection claims for whistleblowers. At the same time, it lays down rules that whistleblowers must observe when reporting. Protection for the individual whistleblower is based on a series of conduct principles, which in turn offer your company opportunities for legal action if a whistleblower makes an unwarranted public disclosure.

Scope of whistleblower protectionis

First, it should be noted that whistleblower protection is not unlimited, but is subject to substantive limitations in addition to compliance with codes of conduct. The directive describes ten areas of application, such as product safety or public health, which limit the scope of the right to protection (Art. 2(1)(a)).

If a whistleblower publishes information that does not fall into one or more of these areas, the directive no longer applies. Although these areas cover a range of cases, gaps still arise. This makes it all the more important to ensure the whistleblower's anonymity. This became clear recently, for example, in the whistleblower case of Tönnies canteen. The employee of the canteen operator was dismissed there after she published a video on YouTube which brought the company's lax approach to Corona protection measures to light. Not punishable? If one considers the eighth scope of application, public health, the answer could be „yes“. Mind you: could. Because the Whistleblower Directive does not provide for the application of infection protection regulations, which would be necessary for a clear answer.

From a perspective, it is up to the legislators of the EU member states to close such loopholes in the transposition into national law – or indeed not. For you as an entrepreneur and your whistleblower, the consequence is: infringements outside the scope are not protected ex ante by the directive. In other words, not everything that is reported automatically qualifies the person for the right to protection.

A further substantive requirement for the whistleblower is that the information concerns an infringement of EU law and is true at the time of reporting (Article 6(1)(a)). In this way, the Directive distinguishes reports that are void or untrue from those that are eligible for protection.

Obligations for the Employee: The Reporting Cascade

Aside from that, principles of conduct that whistleblowers must observe when reporting are relevant to you. The medal has two sides: on the one hand, the whistleblower's claim to protection. On the other hand, the obligation to adhere to these rules. The latter are a prerequisite for the whistleblower to be legally in the clear. Where the whistleblower fails to observe the rules, you as an entrepreneur have the means for legal consequences at your disposal. Essentially, it is about an escalation cascade, which contains the following three stages:

Internal Announcement

The directive stipulates as a „fundamental principle“ that the reporting of information should primarily be done through internal company channels (Article 7(1), (2)). EU Member States are encouraged to emphasise the internal reporting channel as the primary one when transposing the directive into national law. For you as an entrepreneur, this means you must provide an internal channel for reporting information (Article 8(1)). This can take various forms, for example, through a designated person or a department (Article 8(5)). If you have informed the whistleblower in advance about the existence of this channel and guarantee the person that their report will be effectively processed, you essentially proactively remove their justification for escalating to the second level, which is external reporting.

Sie haben noch kein Hinweisgebersystem? Informieren Sie sich über die „Choosing a whistleblowing system“ in our blog.

External alert

According to the directive, the whistleblower may also use external channels to submit the report. This can be done either voluntarily and directly, or after the internal channel at escalation level 1 has been unsuccessfully used. If the whistleblower demonstrably has no knowledge of the existence of internal channels, they may also use an external channel directly. What is important for you under all circumstances is: external does not mean YouTube (see Tönnies), Wikileaks (Chelsea Manning), or The Guardian (Edward Snowden). Instead, the directive defines the requirements for such external channels to enable a regulated processing of the report. The EU Member States, for their part, must ensure that „competent“ official bodies are established for reporting. If the whistleblower accidentally chooses the wrong authority, it must ensure that the report safely reaches the intended authority in a short period of time (Art. 11 Para. 6).

In Germany, these channels are to be covered by both sector-specific and non-sector-specific institutions. The former, modelled on BaFin, will serve as a point of contact for specific professional groups, although this is still quite isolated and further institutions will follow. Sector-non-specific institutions include offices such as the public health department, which would have been the perfect external channel in the case of the Tönnies canteen. The route to the responsible public prosecutor's office also falls into this category.

Concrete requirements for these bodies are also specified in the directive, including ensuring the confidentiality, integrity and completeness of the report received (Article 12(1)(a)). Furthermore, employees of such bodies must even be trained for the purpose of processing the report appropriately (Article 12(5)). As you can see, the existence of such external bodies is ultimately advantageous for you, as they can channel grievances in such a way that your company does not suffer public damage. This therefore represents another important form of de-escalation for you, which you can leverage through transparent communication with your employees.

Public notice

Public reporting represents the third stage of escalation. Due to the multiplication factor of the media and the simultaneous interest of the public, it is arguably the most prominent stage. This is despite the fact that, in an ideal world, it should not be used at all. Because, in order to protect companies, the directive treats this path as a „last resort“, which, by definition, should only be used in the following cases:

1. The whistleblower has already used the internal and/or external channel but has not received feedback within the prescribed time (Art. 15(1)(a)).
2. The incident to be reported poses a significant danger with irreversible consequences for the public (Art. 15(1)(a)(i)).
3. The referrer has reason to believe that the report will not be processed effectively or that they may fear retaliation as a result of the report.

Do you notice anything? With the exception of point two, they have direct levers to prevent public whistleblowing. Apart from that, the report must still fall within the scope of the directive for the whistleblower to be entitled to protection. By taking certain measures, which are described below, you can play it safe and remove the whistleblower's basis for any public reporting. Consequently, should the person still go public, you will have criminal and labour law consequences at your disposal. This makes the whistleblower system... Your company's shield.

Measures to prevent escalation

In principle, it should be clear to both parties, the whistleblower and the employer: escalation is avoidable. The following measures on your part will help with this:

Enlightenment

The most effective way to counteract whistleblowers going public is proactive and demonstrable communication about the reporting systems you offer. Demonstrability can, in the classic sense, already be ensured in the whistleblower's employment contract. Regarding whistleblowing by your own employees, a clause in the employment contract that makes your employees aware of the company's own channel as well as external reporting offices provides a remedy. This closes the loophole for justifications for public whistleblowing based on the lack of an internal channel.

As depicted, whistleblowers can affect further groups of people. It is therefore advisable to reflect on their relationships with all stakeholders and, as a second step, to choose the appropriate medium for communicating the reporting channels. For suppliers, this could be the supply agreement, for customers the general terms and conditions, and for applicants the non-disclosure agreement.

Trust

The more you „empower“ potential whistleblowers to use the prescribed channels, the more effectively you will prevent them from going public with their whistleblowing. This is because trust in the channels is paramount for their actual use. Furthermore, you also prevent the risk of whistleblowers turning directly to the public with the argument of a lack of confidence in the handling of their report. A corporate culture based on integrity helps to bring the clause in the employment contract (or similar) regarding reporting to prescribed channels to life, so that it does not become an unread clause. This makes it tangible for whistleblowers and a foundation for legal claims against the public whistleblower for you.

Transparency

Ultimately, transparency in the reporting process is an important vehicle for taking the wind out of the sails of public whistleblowers. Regular, direct communication with the whistleblower will transform your system from a crystal ball into a clearly regulated communication channel. Your whistleblower will then know that the report is being handled appropriately and that they can refrain from further escalation. Against this backdrop, the EU Directive has established timeframes that companies must adhere to when processing reports.

1. The acknowledgement of receipt must be sent to the whistleblower seven days after receipt (Art. 9 para. 1 letter b).
2. Three months after the confirmation is sent, the whistleblower must receive feedback on their report (Article 9(1)(b)).
3. If the internal investigations prove to be particularly complex, this deadline will be extended to six months.

If these deadlines are met, there will continue to be no primary claim for the whistleblower to leave this reporting channel, meaning that labour and criminal consequences could be taken against you should they decide to go public nonetheless.

Employment law consequences in the event of the scandal

What should be done if the whistleblower has not followed the escalation stages as intended? Your focus should be on preventing precisely this scenario. If this has not been successful, you are free to initiate employment and criminal proceedings, which will be described below in the event that the whistleblower is an employee.

The admonishment

Firstly, in employment law, you have the option of issuing a warning to the whistleblower. While this measure is generally a viable option in a range of cases, it is likely to be of little value in the context of whistleblowing for the following reasons. For one, the so-called reprimand function, which alerts the employee to the breach of contract, has little effect, as practice suggests that whistleblowers are well aware of the breach. Secondly, because the demand function, which aims to stop the behaviour, is rarely applied. Finally, the majority of whistleblowers have already broken ties with the company concerned by the time of escalation to the public, making a change in behaviour redundant. Apart from that, there are various practical problems, such as the integration of the whistleblower back into the workforce and a lack of trust from colleagues.

The letter of caution

With a formal warning, the warning function is added to alert the informant about termination in the event of a repeat offence. This too is unlikely to be of much help as a legal consequence. You can essentially determine whether a reprimand or formal warning is still an option by asking the following two questions:

1. May my whistleblower resume their work?
2. Do I now have security that the whistleblower will report any incidents in accordance with the directive in future?

In the event, which is experientially unlikely, that they can both answer „Yes“ to the questions, these means may be an option.

The termination

In all other cases, termination is another option, which can be ordinary or extraordinary. While the former occurs in compliance with contractually defined notice periods, the latter requires important grounds for termination (§ 626 Paragraph 1 of the German Civil Code). The deliberate, targeted dissemination of internal information to the public, for instance, could fall under this, depending on the interpretation. At this point, it is clear that damages arise from the incident and the disclosure. In the best-case scenario, this is in the form of costs for re-filling the position. In the worst-case scenario, costs arise from a possible lawsuit and penalties levied on the whistleblower; for example, if the grounds for termination prove to be baseless. Furthermore, they have the option of a claim for damages. However, this is not very practical, especially in simple employment relationships outside of the C-suite.

When employment law escalations occur, the risk of reputational damage should not be underestimated. Such proceedings can quickly become public, as the recent Tönnies case or the Bottrop pharmacy scandal, with their lengthy disputes before the competent labour courts, demonstrate. When discussing the exact grounds for dismissal, employers in the media spotlight often find themselves in a difficult position, needing to explain themselves.

Criminal consequences in the case of the scandal

Finally, you have the opportunity to take legal action against the whistle-blower. However, before filing a criminal complaint, you should carefully weigh up your chances of a successful prosecution with in-depth consultation from your legal experts. The question of „success“ should include the matter of any claims that may be awarded, as well as potential legal repercussions. The latter could backfire on you with a counter-complaint from the whistle-blower and lead to intervention by the public prosecutor's office; for example, in cases of false accusation or slander. Here too, long-term disputes are typical, which tie up capital and resources, and are only worthwhile in rare cases.

Consequences for external whistleblowers

When it comes to external whistle-blowers, such as suppliers, different rules generally apply. Where the whistle-blower is a legal entity, the chain of evidence is typically more complex than for an employee whistle-blower. However, the consequences also cover a spectrum from mild to severe measures. The former can be an informal discussion, in which the partner is admonished, for example, to handle business secrets more carefully. This contrasts with the possibility of terminating the contractual relationship with immediate effect and pursuing claims for damages.

Conclusion

In summary, your strongest tool for a legally sound position is to take ex-ante measures before a scandal arises. As demonstrated, extensive education, as well as trust-building and transparency measures, play key roles here. Although whistleblowers gain comprehensive protection rights through the EU Whistleblower Directive, this is subject to substantive and procedural rules. If you have taken all recommended measures on your part, whistleblowers will quickly exceed their legal scope of action if they go public with their report. Ex-post, i.e., after a scandal has occurred, the labour and criminal law consequences outlined are available to you. However, since these rarely proceed smoothly and always represent a risk of damage, these steps should be carefully considered and planned. On the other hand, fundamental diligence in the implementation and communication of your reporting system, whether through contractual clauses or information campaigns, pays off. True to the motto: „Better to have and not need, than to need and not have“!

Find out about the „Costs of a whistleblowing system“ and download our Guide to implementing the Whistleblower Protection Act in your company , to learn how you can work cooperatively with whistleblowers.

We would be happy to advise you in a non-binding consultation; click here for the Contact form.

(The masculine form used refers to all people, regardless of gender.)