FAQ - ManagingCare Digital

Companies and organisations with 50 or more employees must operate secure internal whistleblowing systems. Smaller companies with between 50 and 249 employees are granted an implementation period until 17 December 2023. Companies with more than 250 employees are obliged to implement the system from the date of entry into force (1 July 2023). Fines will be due from 1 December 2023 if companies/organisations have not set up an internal reporting office. Employees within the meaning of the HinSchG are employees, trainees, civil servants, self-employed persons and home workers.

The Whistleblower Protection Act aims to ensure comprehensive protection for whistleblowers. The aim is to reduce the risk for people who report irregularities in their company or authority.

The company can also make the reporting channel available to persons who are only in contact with the company, e.g. as part of a business relationship, so that they can report information about violations.

§ Section 7 para. 1 HinSchG states that the whistleblower has the choice of whether to report a matter to an internal or external reporting centre. If, for example, the internal reporting centre is unable to follow up on the report, the whistleblower has the option of contacting the external reporting centre. However, it is emphasised that the internal reporting office should be given preference.

Bei der Inanspruchnahme eines IT-Dienstleisters, der eine entsprechende cloudbasierte Lösung anbietet, handelt es sich in der Regel um eine Auftragsverarbeitung im Sinne des Art. 28 DS-GVO. Das bedeutet, dass in einem ersten Schritt ein entsprechender Vertrag mit dem Dienstleister geschlossen werden muss, der die Anforderungen des Art. 28 Abs. 3 DS-GVO erfüllt. Dazu gehören insbesondere: Die Weisungsgebundenheit bei der Verarbeitung personenbezogener Daten: - Die Verpflichtung zur Wahrung der Vertraulichkeit - Das Ergreifen angemessener technischer und organisatorischer Maßnahmen - Klare Regelungen für den Einsatz weiterer Unterauftragsverarbeiter

Once a report has been received, it must be confirmed by the internal reporting office within seven days. The person handling the report has a total of three months to inform the reporting person of the measures taken. To this end, the report is reviewed and the reporting person may be asked to provide further information. The measures ultimately taken may include the initiation of an internal compliance investigation or the forwarding of the report to a competent authority, such as a law enforcement agency. Strict confidentiality is maintained throughout the entire process, not only with regard to the identity of the person making the report, but also with regard to all persons named in the report. The standard retention period of three years applies, unless it is required by law to retain the information for longer (decided on a case-by-case basis).

In the case of telephone reports, a permanently accessible audio recording or verbatim transcript may only be made with the consent of the person providing the information. If consent is not given, only a summary of the content may be prepared. In the case of a personal meeting, recordings of the meeting may also be made and stored with the consent of the person providing the information. This can be done by means of an audio recording or the creation of a verbatim transcript.

- Section 14 (1) HinSchG states that an internal reporting office may be managed by employees of the company. The prerequisite for this is the necessary expertise and the ability to work independently in order to avoid conflicts of interest. - In order to protect whistleblowers, the circle of persons who have access to incoming reports should be kept as small as possible. Office or IT staff, for example, may be considered as ‘supporting persons’ insofar as they perform a supporting function.