Three-tier reporting system
The three-tier reporting system describes the reporting channels available to whistleblowers under the German HinSchG: the internal reporting office, the external reporting office and, as a last resort, public disclosure.
The three-tier reporting system is the core architecture of whistleblower protection under the German Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), which transposes the EU Whistleblower Directive (Directive (EU) 2019/1937) into German law. It comprises three reporting routes that build on one another: a report to an internal reporting office at the whistleblower's own employer (tier 1), a report to an external reporting office of a public authority (tier 2), and public disclosure of information, for example to the press or media (tier 3).
The legal relationship between the tiers is decisive: under § 7(1) HinSchG, whistleblowers have a free choice between internal and external reporting. They are not required to report internally first and may turn directly to an external reporting office. However, § 7(1) sentence 2 HinSchG recommends internal reporting where the breach can be addressed effectively internally and no reprisals are to be feared. Employers are expected to create incentives for internal reporting.
Unlike the free choice between the first two tiers, public disclosure as the third tier is protected only under narrow conditions set out in § 32 HinSchG. It applies where, following an external report, no appropriate follow-up measures were taken within the statutory deadlines, or where the whistleblower has reasonable grounds to believe that the breach constitutes an imminent or manifest danger to the public interest, that reprisals are threatened, or that evidence may be suppressed. Only those who observe this tiered logic retain full protection against reprisals.
Legal Basis
§§ 7, 32 HinSchG; Art. 7, 10, 15 Directive (EU) 2019/1937
Practical Example
An employee uses her employer's internal reporting channel to report a suspicion of systematic billing manipulation. After acknowledgement of receipt and assessment, she receives no feedback on follow-up measures within three months. As a compliance officer, you document the matter cleanly, because the whistleblower may now turn to the Federal external reporting office. If an appropriate response failed to materialise there too within the deadline, a protected public disclosure to the press would even be possible under the conditions of § 32 HinSchG.