On 14 November 2005, the Düsseldorf Regional Labour Court (“Landesarbeitsgericht Düsseldorf”) ruled that Wal-Mart’s current Whistle-blowing Policy breaches German labour law. The decision confirms the Wuppertal Labour Court’s (“Arbeitsgericht Wuppertal”) previous decision of 15 June 2005 which held that the policy was unlawful. However, Labour law is only one side of the coin. The courts left open the question of what requirements should be imposed in order for a whistle-blowing policy to comply with data protection law.
The Düsseldorf and Wuppertal decisions concerned the Wal-Mart Statement of Ethics (“Policy”) which sets out a code on appropriate conduct in the work place. It ranges from statements to the press, to harassment of colleagues; and from personal relationships between colleagues, to reporting potential misconduct (“whistle-blowing”). With regard to whistle-blowing, the policy requests Wal-Mart’s employees (without compelling them) to report anonymously via a hotline any potential infringement of the policy’s provisions.
The policy had been implemented by Wal-Mart in Germany without consulting the works council. The works council subsequently requested that the Wuppertal Labour Court rule, among other things, that Wal-Mart may not operate the whistle-blowing hotline without either the works council’s consent or a mediation decision in place of the works council’s consent.
The Wuppertal Labour Court granted the motion filed by the works council. The court ruled that the implementation of a certain procedure for how to report information concerns the inner structure of the company. Such a procedure is subject to co-ordination with the works council (“Betriebsrat”) according to Section 87 para. No. 1 of the Works Constitutional Act (“Betriebsverfassungsgesetz”). Also, the operation of the telephone hotline requires the involvement of the works council as it is a technical means to monitor the employee’s conduct (Section 87 para. No. 6 Works Constitutional Act).
Wal-Mart’s appeal against this decision has now been rejected by the Düsseldorf Regional Labour Court. On 14 November 2005, the Regional Labour Court ruled that the request to use a hotline, and the operation of the hotline itself, are subject to coordination with the works council. But this might not be the end of the matter as an appeal to the Federal Labour Court has been allowed.
Neither decision addresses any data protection issues. Indeed, they are pure labour law decisions that do not contain indications on how whistle-blowing has to be assessed under German data protection law.
However, the decision has drawn public attention to this very specific legal question. Companies, in particular US stock listed companies, are in a dilemma: on the one hand, US law obliges them to implement corporate governance listing standards for companies, including the implementation of procedures encouraging employees to report misconduct (comp. e.g. Section 303 A No. 10 New Stock Exchange’s Listed Company Manual); on the other hand, European law (in particular data protection law) imposes mandatory restrictions on such whistle-blowing.
A decision of the German Federal Court of Justice (“Bundesgerichtshof”) indicates that German data protection law generally accepts whistle-blowing to a certain extent. Although expressly addressing only labour law issues, it held that an employer may request that his employees report misconduct (comp. BGH DB 1989, 1464). However, the precise scope of such a legal whistle-blowing obligation is still open. In the absence of relevant case law or administrative guidance, general data protection law provisions have to be applied. In the private sector, these provide for a balance of interests according to Section 28 Federal Data Protection Act (“Bundesdatenschutzgesetz”). The whole principle of balance of interests means it is not possible to make a general assessment of whistle-blowing policies; instead, policy provisions must be reviewed in each individual case. The balance of interests must consider, among other things, the severity of the alleged misconduct on the one hand; and on the other hand, the alleged infringer’s interest in not becoming the subject of an unfounded investigation. In addition, the reporting employee’s privacy interests must be taken into account.