Q: How is the anonymity of the whistleblower ensured on the WhiteSparrow platform?

Unser Hinweisgebersystem gewährleistet die Anonymität des Hinweisgebers und stellt sicher, dass dessen Identität auf technischem Weg nicht zurückverfolgt werden kann. Technische Daten, die zur Übermittlung des Hinweises erforderlich sind, sind nur einem sehr eingeschränkten Personenkreis und nur für kurze Zeit zugänglich. Die Daten werden in hochsicheren Rechenzentren gespeichert, die nach ISO 27001/2 sowie weiteren Standards zertifiziert sind. Auf diesen Servern werden keinerlei IP-Adressen, Standortdaten, Gerätespezifikationen oder sonstige Daten dauerhaft gespeichert, die Rückschlüsse auf den Hinweisgeber zulassen. Der Hinweisgeber entscheidet selbst, ob er anonym bleibt oder persönliche Angaben zu seiner Person macht. In jedem Fall werden Meldungsinhalte nur verschlüsselt übertragen. Zudem erfolgt die gesamte Serverkommunikation über eine verschlüsselte TLS 1.2.(HTTPS)-Verbindung. Externe Hosting-IT-Dienstleister haben keinen Zugriff auf die Daten.

Question 1

What does the EU Whistleblowing Directive in conjunction with the German Whistleblower Protection Act mean for companies?

Accepted Answer

The EU Whistleblowing Directive, officially known as Directive (EU) 2019/1937, is a piece of European Union legislation that regulates the protection of persons who report breaches of the law in their professional environment (so-called whistleblowers). This directive was adopted on October 23, 2019 and sets binding minimum standards for the protection of whistleblowers in all EU member states.

The EU directive has been transposed into national law in all EU member states.

The German Whistleblower Protection Act (HinSchG) therefore came into force on July 2, 2023 in accordance with Article 10 (2). Since then, companies with 50 or more employees have been obliged to maintain an internal reporting office.

We present the most important points of the law here:

1. the material scope of application

There is a significant difference to the Directive in terms of the material scope of application: While the Directive only protects whistleblowers in the event of violations of EU law, the HinSchG also applies to violations of criminal provisions of the German Criminal Code and certain administrative offenses punishable by fines. Section 2 of the HinSchG continues to list the individual areas of law and topics covered by the HinSchG.

Finally, the agreement in the Mediation Committee resulted in a change to the definition of the term “information” that is reported: Accordingly, the HinSchG now only applies if the reported information concerns breaches committed or very likely to be committed at the employment employer where the whistleblower is or was employed, or at another body with which the whistleblower is or was in contact due to their professional activity, as well as attempts to conceal such breaches.

2. the processing of anonymous reports

The obligation to set up a reporting channel that also enables the submission of anonymous reports, which was originally provided for in the draft legislation, is no longer included in the HinSchG that has now been adopted. However, unlike the EU Directive, the HinSchG stipulates that companies should also process reports in which the whistleblower does not provide any personal details - so-called anonymous reports. This also appears to make sense, as company managers can thus receive valuable information about events in their own company. When selecting a solution, it is therefore advisable to ensure anonymous two-way communication.

3. personal meeting has been defused

The obligation to enable a personal face-to-face meeting at the request of the whistleblower has been relaxed: According to the Whistleblower Protection Act, the meeting can now also take place by means of video and audio transmission with the consent of the whistleblower.

Status: 11.10.2024

Question 2

Which companies are affected and what should be done?

Accepted Answer

Reporting options must be set up by companies with at least 50 employees and by companies from certain sectors regardless of the number of employees, e.g. all financial service providers, aviation and maritime shipping.

The decisive factor is the regular number of employees, but not a specific reference date. These companies and other employers are obliged to set up and operate an internal reporting office to which employees can turn.

Status: 11.10.2024

Question 3

Is my company affected even though it has fewer than 50 employees?

Accepted Answer

● Are you an investment service provider (Section 2 (10) of the German Securities Trading Act)?

● Are you a data provision service (Section 2 (40) of the Securities Trading Act)?

● Are you an exchange operating company within the meaning of the Stock Exchange Act?

● Are you a credit institution (Section 1 (1) (b) of the German Banking Act)?

● Are you an institution within the meaning of Section 2 (1) of the Securities Institutions Act?

● Are you an investment management company (Section 18 (1) of the German Investment Code)?

● Are you subject to the Insurance Supervision Act (Section 1 (1) Insurance Supervision Act)?

● Are you a counterparty to a securities financing transaction?

If you have answered “yes” to at least one of the questions, you are obliged to set up an internal reporting office regardless of the number of employees. If you are not sure, you are welcome to contact us for a non-binding consultation.

Status: 11.10.2024

Question 4

Is the public sector also affected by the EU Whistleblower Directive and the Whistleblower Protection Act?

Accepted Answer

When the German Whistleblower Protection Act comes into force on July 2, 2023, whistleblowers will also be better protected against reprisals in public administrations, municipalities, municipal companies and other public employment agencies.

In the meantime, most of the federal states have passed whistleblower reporting office laws under state law or implemented the requirements of the Whistleblower Protection Act in existing state law, thereby creating the legal basis for the operation of internal reporting offices in public administrations.

The obligation to implement the municipal whistleblower reporting office laws or the respective state law applies to

- Municipalities, municipal companies, public administrations / public corporations / authorities and other public employment bodieswith more than 10,000 inhabitants or with more than 50 employees.

Public employers must ensure that whistleblowers have a safe environment in which to disclose any wrongdoing, potential misconduct or breaches of the law in public bodies.

Status: 11.10.2024

Question 5

Which persons are suitable for performing the tasks of an internal reporting office?

Accepted Answer

The authorized persons (employees or third parties as service providers) who process incoming reports of misconduct or grievances must be independent. Other activities within the company are permitted.

The persons must be qualified and acquire the relevant specialist knowledge of the Whistleblower Protection Act in accordance with the EU Directive and the Whistleblower Protection Act.

MKM LEGAL provides training in the basics of the Whistleblower Protection Act and prepares officers for the tasks involved in dealing with whistleblowing, including case studies. Specialist training in german language with certificate of participation - click here to register.

Status: 11.10.2024

Question 6

What are the benefits of a whistleblower system and how is the system implemented?

Accepted Answer

A whistleblower system or reporting platform generally takes into account all the requirements of the HinSchG and therefore represents an ALL-IN-ONE solution for legally compliant whistleblower management. As a result, those responsible minimize liability risks and protect themselves from possible fines, sanctions or potential reputational damage.

The use of a system also saves resources and costs.

Onboarding the WhiteSparrow reporting platform is simple and straightforward. Based on the information you provide in an onboarding checklist, we equip your platform with your CI. If a works council exists and the co-determination rights of the works council have been safeguarded, it only takes a few days to set up your whistleblowing system. At the same time, an appointment will be made to brief your team and you will receive text templates on request to inform employees and partners.

Status: 11.10.2024

Question 7

Is there help with tricky messages and is there support?

Accepted Answer

Personal support is available to answer your questions about the WhiteSparrow system by e-mail and telephone. We can help you quickly, competently and with a wealth of experience.

We recommend that you keep calm when you receive a sensitive message: Keep calm! Rely on your expertise and the tools you have gained from our specialist customer training. If it turns out that you can't get any further, feel free to contact us. We can give you ideas on the next steps to take in the event of difficult incoming reports or actively support you if necessary. We will let you know in advance when services will become chargeable. In individual cases, we will also refer you to our MKM legal experts.

Status: 11.10.2024

Question 8

Is the system also suitable for groups / group companies?

Accepted Answer

The international legal security of the whistleblowing platform in all EU countries enables secure and centralised use for corporate groups.

The WhiteSparrow system is multi-client capable and provides each group company with its own portal for whistleblowers. Reports from all companies within the group can be managed and processed centrally. A dedicated rights and roles concept takes into account important features such as the dual control principle, the involvement of users, e.g. for a single report, or deadline control.

We will be happy to provide you with a free demo version for your team to test at their leisure.

Question 9

Does the works council have to be involved in the introduction of a whistleblower system?

Accepted Answer

You should always involve the works council when introducing a new or changing an existing whistleblowing system. On the one hand, this is required under Section 87 (1) No. 1 BetrVG if the whistleblowing system imposes reporting obligations. On the other hand, there is a right of co-determination pursuant to Section 87 (1) No. 6 BetrVG if technical equipment is to be introduced or used which is intended to monitor the behaviour or performance of employees.

The labour law experts at MKM + PARTNER Rechtsanwälte will also be happy to support you in concluding a works agreement and negotiating with the works council.

Question 10

How is the anonymity of the whistleblower ensured on the WhiteSparrow platform?

Accepted Answer

Unser Hinweisgebersystem gewährleistet die Anonymität des Hinweisgebers und stellt sicher, dass dessen Identität auf technischem Weg nicht zurückverfolgt werden kann. Technische Daten, die zur Übermittlung des Hinweises erforderlich sind, sind nur einem sehr eingeschränkten Personenkreis und nur für kurze Zeit zugänglich. Die  Daten werden in hochsicheren Rechenzentren gespeichert, die nach ISO 27001/2 sowie weiteren Standards zertifiziert sind. Auf diesen Servern werden keinerlei IP-Adressen, Standortdaten, Gerätespezifikationen oder sonstige Daten dauerhaft gespeichert, die Rückschlüsse auf den Hinweisgeber zulassen. 

Der Hinweisgeber entscheidet selbst, ob er anonym bleibt oder persönliche Angaben zu seiner Person macht. In jedem Fall werden Meldungsinhalte nur verschlüsselt übertragen. Zudem erfolgt die gesamte Serverkommunikation über eine verschlüsselte TLS 1.2.(HTTPS)-Verbindung. Externe Hosting-IT-Dienstleister haben keinen Zugriff auf die Daten.

Question 11

What is meant by the term ‘internal’ reporting office? Is outsourcing to external third parties possible? Can a whistleblowing system be shared?

Accepted Answer

Of course, setting up and maintaining a whistleblowing centre requires a lot of resources. It is therefore permissible to outsource the ‘internal’ reporting channel to external third parties - as long as confidentiality and data protection are guaranteed.

Can several reporting centres share a whistleblowing system? In the private sector, yes, as long as the system enables strict data separation between the companies. With WhiteSparrow, we offer a platform that not only enables your employees to submit confidential reports - it also allows small companies and groups to share resources.

In the public sector, depending on the federal state, local authorities, municipalities, districts or other public employers can jointly set up and operate internal reporting centres or commission a third party with the tasks of an internal reporting centre and the operation of reporting channels.

Various models are permissible, such as inter-municipal cooperation within the framework of a municipal special-purpose agreement or the transfer of tasks within municipal group companies.

The obligation to take measures to remedy any violations remains with the municipalities and public employers involved.

White Sparrow

Legally compliant whistleblowing system

Digital whistleblowing platform

What characterises our whistleblower system?

These companies have successfully deployed White Sparrow

Start reporting platform - step by step

Initial consultation incl. free demo

Onboarding

Information for potentially affected persons

Extended application possibilities

Also usable for other (international) laws

How a whistleblowing platform works

This is what White Sparrow looks like

Many customisations possible

Submission of a notice

Processing of the notice

Still have questions?

Questions and answers

White SparrowLegally compliant whistleblowing system

Digital whistleblowing platform

What characterises our whistleblower system?

These companies have successfully deployed White Sparrow

Start reporting platform - step by step

Initial consultation incl. free demo

Onboarding

Information for potentially affected persons

Extended application possibilities

Also usable for other (international) laws

How a whistleblowing platform works

This is what White Sparrow looks like

Many customisations possible

Submission of a notice

Processing of the notice

Still have questions?

Questions and answers

White Sparrow

Legally compliant whistleblowing system