barbara mayer gesellschaftsrecht pz.jpgmoritz jenne gesellschaftsrecht p.jpg

Whistleblower Directive: New Compliance requirements for numerous companies

The "Lux Leaks" and "Panama Papers" financial scandals have one thing in common: they were made public by whistleblowers. The personal consequences for whistleblowers are often serious. The EU took this as an opportunity to issue a directive on the protection of whistleblowers (EU Directive 2019/1937).

A central component of the directive is the establishment of an obligation to set up internal whistleblower systems. This obligation applies in principle to companies with 50 or more employees. The companies concerned have to enable the reporting of legal violations and comply with certain procedural requirements and deadlines. Internal reporting channels are to be given preference over external reporting to authorities. It applies to all companies that any form of reprisal, in particular dismissal, in response to a report of legal violations is inadmissible. In the future, if a whistleblower defends himself or herself against termination, it will be up to the employer to prove in court that the termination is not related to the reporting of violations but is based on other grounds. In addition, companies will face sanctions for violations of the directive, which are to be determined by the member states.

The directive must be implemented in the EU member states by December 17, 2021. The lynchpin of the political discussion is the question of which legal violations should be covered by the implementation law, since all of the directive's requirements relate exclusively to the reporting of violations in specific areas of EU law, such as violations in the area of European consumer, environmental or animal protection. However, the (German) draft legislation also covered infringements of German law, e.g. reports of tax evasion or non-compliance with German occupational health and safety regulations. If the directive is not implemented in due time, there is considerable legal uncertainty for companies, as the directive can  become relevant by way of an interpretation of German law in conformity with the directive, despite the lack of implementation.


All companies with 50 or more employees should start by setting up an internal reporting system for compliance violations that are to be treated confidentially. Both in-house employees and external third parties such as lawyers can be appointed to receive reports, provided they can maintain independence and confidentiality. In the event of a dispute, companies should be able to prove that there is no connection between the reporting  of violations and a termination by means of appropriate documentation.

1:1. This is how we work together. You decide upon a competent partner; he/she will then remain your point of contact. > more