On December 16, 2019, the European directive on the protection to persons who report breaches of Union law (“Whistleblower Directive”), came into force.  The directive imposes an obligation to set up reporting channels for companies with 50 or more employees, companies in the financial services sector, and for public sector legal entities. Furthermore, the directive provides a strong protection for the whistleblowers themselves as well as their supporters. The national legislators of the member states of the European Union have to implement the directive into national law by December 17, 2021. The implementation period for establishing an internal reporting channel is two years longer for companies with 50 to 249 employees, and therefore ends on December 17, 2023 for them.

The protection of the directive refers to the reporting of legal violations in the areas explicitly listed in the directive (e.g. money laundering, product safety, traffic safety, environmental protection, data protection, tax fraud). The national implementation of the directive may also lead to an expansion of the catalogue of criteria. The directive protects informants who have obtained such information in a professional context. An informant can therefore be a (former) employee, supervisory board member, business partner, trainee or job applicant. It also protects persons who assist the whistleblower in reporting procedures in a professional context and whose assistance is confidential (e.g. works council members) and others who are associated with the whistleblower and could suffer sanctions in a professional context.

The directive provides a multistage reporting system. Initially, an informant should be able to submit violations to an internal reporting system that must meet certain criteria. This includes, for example, the security of the system and the confidential treatment of the identity of the informant. Furthermore, there must be the possibility to submit notifications in writing, orally or in a physical meeting. Additionally, it must be ensured that unauthorized employees do not have access to these messages. If no action is taken by the company after a violation has been reported to an internal reporting system, or if there is no internal reporting system at all, the whistleblower can turn to an external reporting channel (e.g., public authority). In this regard, the Austrian legislator must determine the authorities that will be responsible for such reports in Austria (plausible would be the Ombudsman Board, a new ombudsman institution, or the data protection authority). In case the external reporting system does not function either, or when the informant has sufficient grounds to assume, in advance, that a violation will endanger public interest, the designated, next escalation level is to raise public awareness (e.g., via the media).

The directive provides that informants shall be fully protected from any form of extortion or other retaliation (dismissal, termination, reduction in salary, etc.) in their workplace. In this regard, they benefit from a reversal of the burden of proof. If an informant has pointed out a wrongdoing, and consequently experiences disadvantages, the employer must prove that these disadvantages are not linked to the report. Furthermore, a strong protection of the identity, as well as comprehensive information and advice are intended for the informants. Thus, the Whistleblower Directive ensures strong protection under labour-law for the informant. It is therefore advisable for employers to enquire about the specific level of protection before the implementation deadline, and to train affected managers and employees at an early stage.

The directive provides significant sanctions for companies that have not established an appropriate reporting system or take actions such as: obstruct reports; take reprisals against a person protected under the directive; conduct malicious, legal proceedings against that person; or jeopardize the confidentiality of that their identity. If a whistleblower has to turn to external reporting channels or even the public due to the lack of an internal reporting system, a damage of its reputation should also be considered.

The implementation of the Whistleblower Directive provides a barrier for companies and leads in particular to questions in the areas of data protection law, labor law and compliance. It is therefore advisable that companies deal with the issue very quickly in order to implement the reporting system in a timely and legally compliant manner in their day-to-day operations.