HinSchG: Handling Intentionally False Reports

Main article: HinSchG: setting up an internal reporting channel — the full pillar article on the topic.

1. Requirements of § 38 HinSchG

A claim under § 38 HinSchG requires four elements: a report or disclosure, incorrect information, intent or gross negligence, and damage resulting from it. The wording: 'The whistleblower is obliged to compensate the damage arising from an intentional or grossly negligent report or disclosure of incorrect information.' The provision therefore covers more than intent. In practice, however, the evidential threshold remains very high — for 'intentional' as much as for gross negligence.

A second legal consequence runs in parallel and is often overlooked in case handling: under § 9(1) HinSchG, the protection of identity ceases in the case of intentionally or grossly negligently incorrect reports. Anyone considering the § 38 route is therefore also deciding on the confidentiality position for the rest of the procedure.

The counter-check belongs in every assessment: alongside § 38 stands § 35 HinSchG. Under it, a whistleblower cannot be held legally responsible for obtaining the reported information or for accessing it, provided that obtaining it does not as such constitute a separate criminal offence; nor does the whistleblower breach any restrictions on disclosure, provided there were sufficient grounds to believe that passing on the information was necessary to uncover a breach. Nothing can be changed by contract: agreements restricting the rights of whistleblowers are void under § 39 HinSchG.

2. Evidential duties for a § 38 claim

The burden of presentation and proof lies with the claimant — that is, the person injured by the false report, who is not necessarily the employer. Intent or gross negligence must be proven (section 1). Three findings above all serve as indications: a demonstrably incorrect statement of fact which the whistleblower must have known better; a documented personal motive (ongoing unfair dismissal, appraisal or warning proceedings); and a close temporal link between that conflict and the receipt of the report.

All three findings are evidenced from the same case file. As a practical recommendation, it should contain: the date of receipt and the wording of the report, every investigative step with its date and result, the facts that refute the reported information, and the effort incurred in the investigation. Without this chain, the allegation of 'gross negligence' remains an assertion.

Irrespective of the outcome of the investigation, the feedback deadline continues to run: the internal reporting channel provides feedback to the whistleblower within three months of the acknowledgement of receipt of the report — where receipt was not acknowledged, at the latest three months and seven days after receipt; this feedback includes the communication of planned and already taken follow-up measures and the reasons for them (§ 17(2) HinSchG).

Two limits are fixed here: the documentation is subject to confidentiality under § 8(1) HinSchG (section 4), and in Germany it must be erased three years after the conclusion of the procedure — longer retention only where legally required (§ 11(5) HinSchG). In Austria, retention is five years (§ 8(11) HSchG). The § 38 claim is not to be confused with the reversal of the burden of proof in § 36(2) HinSchG, which works in the opposite direction (section 6).

3. Amount of damages

According to the wording of § 38 HinSchG, the benchmark is the damage incurred. In practice, this mainly concerns the reputational damage to the accused and the investigation effort. Practical categories for quantification (practical recommendation, not a statutory catalogue of heads of damage): internal investigation effort (documented hours × internal hourly rate), the cost of an external investigation or advice, the cost of legal enforcement, and measurable consequences for the accused (e.g. lost remuneration components). The basis for quantification is the case file, in which, following the practical recommendation in section 2, the effort incurred in the investigation is also recorded.

More important than the quantification is keeping the tracks apart: the fine, damages against the reporting person and damages following reprisals run independently of one another. Alongside them stands a fourth, equally independent track: a criminal complaint for calumny (§ 187 StGB; Austria: §§ 111, 297 StGB) — see the FAQ. The table assigns the three fine-related and civil-law tracks as well as the competence for fines to their provision and legal area; the criminal complaint is covered in the FAQ.

For the prosecution of the EUR 20,000 offences under § 40(1) HinSchG, a limitation period for prosecution of three years applies (§ 31(2) no. 1 OWiG).

4. Reputation protection for the accused

The duty of confidentiality in § 8(1) HinSchG protects not only the whistleblower but equally the person concerned by a report: the reporting channels must maintain the confidentiality of the identity of the whistleblower, of the persons concerned by a report and of the other persons named in the report; the identity may become known only to the persons responsible for receiving reports and taking follow-up measures and to those supporting them (§ 8(1) HinSchG). How the outcome of the procedure is communicated once the investigation is closed is described in section 5.

Three measures of the reporting channel are practice standard for this — the specific design is a practical recommendation; encrypted storage and access logging also belong in the concept of technical and organisational measures, which is part of the reporting channel's GDPR obligations: the need-to-know principle within the team with a circle of case handlers named in the procedural rules, every extension recorded with a date and a reason; encrypted storage of the reports, kept separate from the personnel file; and an audit trail of all accesses with a timestamp, user identifier and the reason for access, reviewed on a sample basis by the head of the reporting channel.

The most delicate individual case is an access request by the accused under Art. 15 GDPR. The practice for this: a redacted response and deferral under § 29 BDSG — what is redacted is anything that would reveal the identity of the whistleblower or of other persons named in the report, since that identity is subject to confidentiality under § 8(1) HinSchG. The response deadline follows Art. 12(3) GDPR — without undue delay and in any event within one month of receipt of the request; in complex cases an extension by two months is possible, of which the data subject must be informed within the first month, stating the reasons.

Upstream of this is informing the accused about the processing of their data. Data protection notices for whistleblowers and for accused persons are part of the basic GDPR set-up of a reporting channel; for data not collected from the data subject themselves, Art. 14 GDPR is the basis for the information. Practical recommendation: record the time of the notification in the case file; where it is deferred, record the exception relied on with the date and the reasons.

The sanctions side: intentional or reckless breaches of confidentiality under § 8(1) HinSchG carry a fine of up to EUR 50,000 (§ 40(3)), and negligent breaches up to EUR 10,000 (§ 40(4); framework in each case from § 40(6) sentence 1 HinSchG); against legal persons, a tenfold increase is possible in both cases via § 30(2) sentence 3 OWiG (§ 40(6) sentence 2 HinSchG), i.e. up to EUR 500,000 for intentional or reckless breaches.

5. Rehabilitation after a refuted report

Where a false report has been proven, explicit rehabilitation towards colleagues, position and appraisal belongs at the end of the procedure; the aim is to prevent stigmatisation of the person concerned. In this article it is identified as a practical recommendation; its legal anchor is the duty of confidentiality in § 8(1) HinSchG (section 4).

Four steps have proven effective — all of them practical recommendations, not statutory periods:

• Establish the circle of those in the know. Only those who already knew of the report learn the outcome (section 4).
• Review the personnel file. Correct or remove notes that stem solely from the refuted report.
• Catch up on deferred decisions. Appraisal, promotion, project allocation — documented with the reason for the delay.
• Closing memo in the procedural documentation (erasure period see section 2).

Practical recommendation (not a statutory period): rehabilitation promptly after the closing memo, and through the same channel in which the allegations became known.

6. Disciplinary measures against the whistleblower

Disciplinary measures against a whistleblower are not excluded per se. However, where the whistleblower asserts that they have suffered an occupational detriment as a result of the report, it is presumed that this constitutes a reprisal; the party causing the detriment must then prove that the measure was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG). Knowingly false reports are excluded from protection against reprisals (§ 33(1) no. 2 HinSchG); conversely, a whistleblower may claim protection even where the report later proves to be incorrect, provided there was sufficient cause at the time it was made.

The benchmark for drawing the line is therefore sufficient cause at the time of the report. Practical indications that it existed (practical recommendation, not statutory assessment criteria): own perception or a specific source instead of hearsay, the plausibility of the statements at the time of the report, willingness to cooperate in the investigation.

Every measure becomes risky through § 36(1) HinSchG — reprisals against whistleblowers are prohibited, including threatening and attempting them. Dismissal, transfer, formal warning, salary reduction and bullying may constitute reprisals. In its judgment of 11 November 2024 (7 SLa 306/24), the Regional Labour Court of Lower Saxony (LAG Niedersachsen) confirmed the two-stage assessment scheme under § 36(2) HinSchG.

Practical recommendation: for every HR measure following a report, document proof of independence — the occasion, the basis of the decision and the timing must stand without recourse to the report. The personnel decision belongs organisationally separate from the reporting channel, for which the limited circle of those in the know under § 8(1) HinSchG applies (section 4). If that proof fails, a fine of up to EUR 50,000 (reprisal under § 36, framework from § 40(6) HinSchG) and damages under § 37 HinSchG are in prospect.

7. Austria: HSchG instead of HinSchG

In Austria, the Austrian Whistleblower Protection Act (HSchG) applies instead of the HinSchG: there, a knowingly false report is an administrative offence and is punished by the district administrative authority (Bezirksverwaltungsbehörde) with a fine of up to EUR 20,000, and up to EUR 40,000 in the event of repetition (§ 24 HSchG). The German §§ 33, 38 and 40 HinSchG have no identically worded counterpart there; otherwise this article describes the German legal position, unless Austria is expressly mentioned.

• No protection for a knowingly false report: only a person who was able to assume on sufficient grounds that the report was true is entitled to protection (§ 6(1) HSchG). Anyone who reports knowing it to be false falls outside that protection.
• Administrative penalty instead of a fine: this is a genuine difference from Germany — there, a knowingly false report to a reporting channel does not carry a fine, only the knowing disclosure of incorrect information does (section 3).
• Criminal law: instead of the German §§ 186/187 StGB, § 111 StGB (defamation) and § 297 StGB (calumny) apply in Austria.

In addition, the following applies in Austria: whistleblowers entitled to protection are not liable for the factual or legal consequences of a justified report (§ 22(1) HSchG). A justified report made in compliance with the procedure also does not breach any confidentiality obligations, in so far as the whistleblower had sufficient grounds to believe that it was necessary to uncover or prevent a legal infringement (§ 22(2) HSchG). Retaliatory measures are legally ineffective — expressly including disciplinary measures (§ 20(1) HSchG).

Four further differences that carry practical weight where a report is contested: