Co-determination in the setup and organisation of whistleblower reporting offices

This article deals with the co-determination rights of the works council as regards whistleblower reporting offices in accordance with the German Whistleblower Protection Act (HinSchG).

The legislator passed the German Whistleblower Protection Act as a national transposition of the EU Whistleblower Directive (Directive (EU) 2019/1937) in May 2023. However, fines for not having an internal reporting office have only been imposed since December 2023 when the transitional provision expired. In view of this, many companies are currently working out how exactly to implement their obligations under the German Whistleblower Protection Act.

It is not uncommon for works councils to assert co-determination rights in this context. In this article, we examine the extent to which the works council is entitled to co-determination rights in the setup and management of whistleblower reporting offices.

Is it mandatory for employers to set up an internal whistleblower reporting office?

Whistleblowers generally have the right to choose between an internal and external reporting office (section 7 (1) German Whistleblower Protection Act). However, they should primarily consult an internal office, provided that effective internal action can be taken against the specific breach and there is no risk of retaliation (section 7 (1) sentence 3 German Whistleblower Protection Act).

Employers who generally have at least 50 employees, however, have to set up an internal reporting office (section 12 (1), section 3 (8) and (9) German Whistleblower Protection Act). In addition to standard employees, employees also include those employed for vocational training (section 3 (8) German Whistleblower Protection Act).

The organisation of internal whistleblower reporting offices 

If employers have to set up an internal reporting office, they are entitled to choose the organisational form. They can either transfer the tasks to a work unit consisting of the company's employees or outsource them to external third parties (section 14 (1) German Whistleblower Protection Act). 

Regardless of the chosen organisational form, employers must set up reporting channels via which employees can contact the reporting offices (section 16 German Whistleblower Protection Act). Employers are generally at liberty to decide how they organise these channels. They only need to ensure that employees can make reports verbally or in text form.

As soon as a report is received by the internal reporting office, certain procedural steps must be followed (section 17 German Whistleblower Protection Act). Amongst other things, the internal reporting office must confirm the report within seven days at the latest, it must check the validity of the breach and take appropriate follow-up measures. This may involve carrying out internal investigations, for example (section 18 no. 1 German Whistleblower Protection Act.

Co-determination right arising from section 87 (1) no. 1 German Works Constitution Act (BetrVG)

It is sometimes argued that the works council always has a right of co-determination in the organisation of the whistleblower reporting office because there are matters relating to the rules of operation of the establishment and the conduct of employees in the establishment (section 87 (1) no. 1 German Works Constitution Act).

However, a differentiated view is preferable, because as long as employers remain within the statutory framework when establishing the procedure, for example by adopting the procedural steps stipulated by law (section 17 German Whistleblower Protection Act) without requiring the whistleblower reporting office to take further procedural steps, the works council has no co-determination right, as the employer has no autonomy to make decisions.

The situation is different if employers decide to take measures that go beyond the legal framework, for example if whistleblowers are required to use a reporting channel. In this case, the employees' work-related conduct is regulated, with the consequence that the works council must be involved. As with the setup of a complaints office in accordance with section 13 German General Act on Equal Treatment (AGG), the reporting procedure under the German Whistleblower Protection Act is designed to regulate the conduct of employees in relation to the rules of operation in a standardised way. 

For employers, this means that in order to avoid co-determination in the organisation of internal reporting offices, they should ensure that the planned provisions are still within the statutory framework. In particular, voluntary use of the reporting channels should be ensured.

However, an exception applies to the choice of location and the staffing of the whistleblower reporting office: The works council does not have a right of co-determination in these cases, as the choice of location and staffing of the whistleblower reporting office only relate to the employer's organisation, which is not subject to co-determination, and not the cooperation within the company. 

Co-determination right arising from section 87 (1) no. 6 German Works Constitution Act 

The co-determination right when it comes to introducing and using technical devices designed to monitor the conduct or performance of employees (§ 87 (1) no. 6 German Works Constitution Act) is likely to be far more relevant in the organisation of a whistleblower reporting office.

Opinions in the literature differ in this regard. While some take the view that the works council always has such a right of co-determination, others assume that the organisation of the whistleblower reporting offices is not subject to co-determination under this standard. It is more plausible to take a differentiated view and make the existence of the right of co-determination dependent on the configuration of the reporting platform.

If employers decide to operate an internal whistleblower system using a specific software solution, such as a digital reporting platform, which provides information on the identity of the whistleblower and the time of the report, the employer can monitor performance and conduct and the works council has a right of co-determination. In this context, it is irrelevant whether the employer actually intends to monitor the whistleblower. The only thing that matters is the objective suitability of the reporting platform to collect and record information about employees' conduct and performance. 

In order to avoid co-determination, employers should ensure when selecting a reporting platform that reports can only be made anonymously, so that no conclusions can be drawn about the whistleblower’s identity or the time of the report. This would mean that performance and conduct cannot be monitored. 

Caution is also advised when using fields for providing freely written responses. These allow whistleblowers to post additional information to the reporting platform. This creates the risk that this information will allow conclusions to be drawn about the whistleblower's identity and conduct.

Successful implementation of whistleblower protection by involving the works council

In summary, the German Whistleblower Protection Act and the associated co-determination rights of the works council clearly present companies with new challenges. While the law aims to effectively protect whistleblowers and make misconduct within companies transparent, careful consideration and organisation of the internal reporting offices is required, taking into account the co-determination rights of the works council. Companies are therefore well advised not only to comply with the statutory requirements when setting up and organising whistleblower reporting offices, but also to proactively seek dialogue with the works council. Transparent communication and involvement of the works council can not only prevent conflicts, but also create an environment that strengthens employees' trust in the whistleblower reporting offices. Ultimately, everyone involved can benefit from a well-organised and accepted whistleblower system that helps to identify and prevent misconduct in the company and thus makes a significant contribution to company integrity and culture.