Reporting office Whistleblower Protection Act
Gesetzliche Grundlage
Legal basis
On July 2, 2023, the Whistleblower Protection Act (HinSchG) came into force, which serves to transpose the Whistleblower Directive (Directive (EU) 2019/1937) into German law. The law is intended to protect whistleblowers who draw attention to breaches of the law and regulations in companies and public authorities.
As an employee of the university or as a person with a professional connection to the university, you can contact the university's internal reporting office if you become aware that university employees are violating laws and regulations that must be observed.
By notifying the Internal Reporting Office, you give us the opportunity to clarify the matter and take appropriate action. Since submitting a report is often not an easy step and is often associated with the fear of suffering disadvantages as a result of the report, the HinSchG regulates the protection of so-called whistleblowers. Whistleblowers are protected against any disadvantages arising from the report. Reprisals in connection with professional activities (e.g. being passed over for promotion, issuing warnings, dismissal or other disadvantages) due to a whistleblower must be avoided.
If you wish to report grievances, you can contact either the internal or an external reporting office. Even after submitting an internal report, you still have the option of submitting a (further) external report.
Contact Central Internal Reporting Office of the Hanseatic City of Bremen
As an alternative to the internal reporting office at the University of Bremen, you can also contact the reporting office of the Free Hanseatic City of Bremen:
Reporting Office at the Senator for the Environment, Climate and Science: Ms. Drinkuth, Hinweisgebenprotect me ?!swh.bremenprotect me ?!.de
Further information on the procedure and frequently asked questions can also be found on the website of the Senator for the Interior and Sport.
The Internal Reporting Office is responsible for
1. Violations that are punishable by law,
2. Violations that are subject to fines, insofar as the violated regulation serves to protect life, limb or health or to protect the rights of employees or their representative bodies,
3. Other violations of federal and state legislation as well as directly applicable legal acts of the European Union and the European Atomic Energy Community
These include, among others:
- Combating money laundering and terrorist financing,
- Product safety and conformity,
- road safety,
- environmental protection,
- radiation protection and nuclear safety,
- promoting the use of energy from renewable sources and energy efficiency,
- food and feed safety
- Consumer rights and consumer protection,
- protection of privacy in electronic communications, protection of the confidentiality of communications, protection of personal data,
- Security in information technology
4. Violations of federal and uniformly applicable regulations for contracting authorities on the procedure for awarding public contracts and concessions and on legal protection in these procedures once the relevant EU thresholds have been reached, and other violations of financial and tax law.
5. Also included are reports concerning statements made by civil servants that constitute a breach of the duty to comply with the constitution. Particularly sensitive areas, such as the intelligence services and many classified information, are not covered by the Whistleblower Protection Act. Whistleblowers should also note that private misconduct unrelated to professional activities as well as mere speculation and false reports are not covered by the Whistleblower Protection Act. Only facts that are correct and complete to the best of your knowledge should be reported. Please also refer to the website of the Central Internal Reporting Office for Whistleblowers (ZIMS).
Please note:
The Internal Reporting Office is not a point of contact for general complaints.
Please report alleged breaches of data protection directly to the Data Protection Officer of the University of Bremen (datenschutzprotect me ?!uni-bremenprotect me ?!.de).
If you have any indications of other violations, please contact the relevant office (Occupational Safety, Internal Audit, Office against Discrimination and Violence - Expertise and Conflict Counseling (ADE)).
The Internal Reporting Office does not serve to avert acute emergencies or dangerous situations.
Receipt of your report will be confirmed by the Reporting Office Officer within 7 days. The review and assessment will take place within 3 months. You will then be informed of the follow-up measures taken or planned, provided that this does not affect internal inquiries or investigations and the rights of the persons who are the subject of a report or who are named in the report are not impaired.
Your data will be treated confidentially and will not be passed on to third parties. Should it be necessary to provide information about you to third parties due to a legal obligation or to further clarify the violation you have reported, we will contact you beforehand.
Information about you as a whistleblower is voluntary. However, providing contact details will facilitate communication between you and the Reporting Office and speed up the process of investigating the report. The Internal Reporting Office also processes anonymous reports.
If you provide personal details, by submitting the report you consent to us processing and storing this data for the purpose of investigating the report and contacting you. You can revoke your consent at any time for the future.
If the University of Bremen processes your personal data, you have the following rights as a data subject within the meaning of the GDPR:
1. Right to information (Art. 15 GDPR)
You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR.
2. Right to rectification (Art. 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, where applicable, to have incomplete personal data completed.
3. Right to restriction of processing (Art. 18 GDPR)
You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR is met, for example if you have lodged an objection to the processing, for the duration of the examination by the controller.
4. Right to erasure (Art. 17 GDPR)
You have the right to demand that personal data concerning you be deleted immediately if one of the reasons listed in Art. 17 GDPR applies.
5. Right to information (Art. 19 GDPR)
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.
You have the right to be informed of these recipients by the controller.
6. Right to data portability (Art. 20 GDPR)
In certain cases, which are listed in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission of this data to a third party.
7. Right to object (Art. 21 GDPR)
If data is collected on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR (data processing to protect legitimate interests) or on the basis of Art. 6 para. 1 sentence 1 lit. e GDPR (data processing to protect the public interest or in the exercise of official authority), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
8. Right to withdraw consent under data protection law (Art. 7 para. 3 GDPR)
If the processing of data is based on your consent, you are entitled to withdraw your consent to the use of your personal data at any time in accordance with Art. 7 para. 3 GDPR. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected. You can contact us at the above addresses or by email at the following address if you have any further questions on the subject of personal data: contentuni-bremen.de.
9. Automated decision in individual cases including profiling (Art. 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for the conclusion or performance of a contract between you and the controller
(2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
(3) with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests. With regard to the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision. 10.
10. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection regulations. The right to lodge a complaint can be asserted in particular with a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
11. Assertion of your rights
Unless otherwise described above, please contact the office named in the legal notice to assert your rights as a data subject.