The government has submitted the draft of the Whistleblower Protection Act („HSchG“) to the Austrian Parliament in June 2022 (also see the blog post of 19 April 2021). The HSchG is intended to transpose the Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breach of Union law, published in 2019 into national law. Therefore, employers will be confronted with new obligations and requirements to which they will have to react after the HSchG become effective. In the run-up, there was criticism of the HSchG draft from several people, so that the legislator may modify the draft in the future. The following article summarises the most important duties and requirements for companies - with regard to the current draft of the HSchG - and provides possible solutions:

Scope of application

The protection of whistleblowers and people surrounding them against personal disadvantages and unfounded or unjustified suspicions only exists in the case of information that refers to violations of the law in areas of particular public interest. With the HSchG the Austrian legislator extends the protection compared to the Directive of the European Union but does not include areas of life that can typically be the subject of such information (e.g., violations of social insurance obligations, wage dumping, and discrimination). Multiple authorities have criticized that the scope should be extended regarding criminal law terms (fraud, embezzlement, etc.). According to the current draft, the HSchG protects whistleblowers who publish information from the following areas:

1. Public procurement; 
2. Financial services, financial products and financial markets and the prevention of money laundering and terrorist financing; 
3. Product safety and product conformity;
4.  Traffic safety;
5. Environmental protection;
6.  radiation and nuclear safety;
7. food and feed safety, animal health, and animal welfare;
8. public health;
9. consumer protection, protection of privacy, protection of personal data and security of network and information systems;
10.  §§ 302 to 309 Strafgesetzbuch (StGB) and thus part of the criminal violations of official duty, corruption, and related criminal actions.

Submission of information by whistleblowers and whistleblowing places

Whistleblowers can give information directly to in-house or external contact points. According to the current draft of the HSchG, however, whistleblowers shall rather give information internally than externally. Critics stated that the underlying directive does not contain such a prioritization. If it is not possible, appropriate or reasonable to deal with the information in an internal whistleblower system - for example because the internal system is not set up or equipped in accordance with the requirements of the HSchG - and if this proves to be unsuccessful or futile, information shall be submitted to an external place.

Requirements for the internal whistleblowing system

The HSchG requires companies and public legal entities with 50 or more employees to establish internal whistleblowing systems. Regardless of the number of employees companies in the areas of financial services, financial products, financial markets, prevention of money laundering and financing of terrorism, traffic safety, and environmental protection always need to implement internal whistleblowing systems.

These systems have to meet the requirements of the HSchG:

1. whistleblowing systems have to be suitable in accordance with Art 25 of the DSGVO. That means they must be technically and organizationally state of the art;
2. whistleblowing systems have to be equipped with the necessary financial and human resources to fulfil their tasks; they must be able to keep the identity of the whistleblower and other people mentioned by the whistleblower secret;
3. an impartial and unbiased approach shall be taken to the receipt and treatment of whistleblowing;
4. no instructions shall be given to employees who have the authorization to receive and treat with information from whistleblowers;
5.  it must be possible to give information written or orally (by telephone or other means of oral communication) or both.

Treatment of information provided by whistleblowers

The HSchG contains minimum requirements which people who treat with the information given by whistleblowers have to comply with:

1. at least seven days after the whistleblower gave information to the internal system, it has to send the whistleblower a conformation about the receipt of the information, if he/she demands that;
2. upon request of the whistleblower, a meeting to discuss the information shall take place within 14 days at the latest;
3. no later than three months after receiving the whistleblower's advice, the internal body shall inform the whistleblower of the follow-up action (internal investigation, inquiry, etc.) it intends to take or the reasons why the internal body does not follow up the advice;
4. the internal unit or a body responsible for taking follow-up action may be entrusted with taking follow-up actions; 
5.  management may only be informed of the content of a whistleblower's advice under certain conditions (cf. point 3.).

In which cases does the HSchG protect whistleblowers?

The HSchG protects whistleblowers in case they give information to internal or external bodies. But it is also a requirement for the protection that, at the time of whistleblowing, whistleblowers must believe, that the information is true and falls within the scope of the HSchG. Whistleblowers have to decide that based on the actual circumstances and information available to them.

The identity of the whistleblower or of a person affected by the advice has to be protected by the internal and external authorities. This also applies to any information from which the identity of these persons can be deduced.

The internal unit has the right to inform the management of the company about the content of the given information if: 

1. There is a reasonable suspicion of a violation of the law,
2. the notification appears to be suitable to deter similar future violations of the law, and
3. no danger is to be expected as a result of the notification.

The management must not know about the identity of the whistleblower.

Establishment of whistleblower reporting places

Interest of the company

As discussed, companies that fall within the scope of the HSchG have the obligation to enable whistleblowing internally by setting up an internal whistleblowing opportunity. A look at the penal provisions of the HSchG reflects, however, that companies do not get punishments if they do not establish a whistleblowing spot.

However, the draft of the HSchG intents in its penal provisions that the obstruction of a person in connection with whistleblowing is a crime. Because the non-establishment of an internal whistleblowing place could prevent whistleblowing and thus be subsumed under the criminal offence of the HSchG, several parties have claimed a clarification of the penal provisions.

Instead of working with punishments the HSchG rather tries to motivate companies to implement an internal reporting system voluntarily. The explanations to the HSchG undoubtably reflect this will of the legislator. By this means the legislator tries to emphasize the advantages of striving for legally compliant procedures as well as an internal way of dealing with indications of violations of the law.

The incentive system intended by the legislator to set up an internal whistleblowing place is a fundamentally valid idea. By setting up an internal whistleblowing place, the legal entity can, for example, avoid external whistleblowing, which would have a potentially high public impact. Furthermore, the draft of the HSchG discusses whether the establishment of an internal whistleblowing place could constitute a mitigating reason according to the Austrian Association Responsibility Act (Verbandsverantwortlichkeitsgesetz, VbVG). By setting up an internal whistleblowing spot, measures can also be taken in a timely manner, which can ultimately reduce association fines. The following assessment criteria determine these fines:

1. the extent of the damage or risk for which the association is responsible;
2. the extent of the benefit obtained by the association from the offence; and
3. the extent of the unlawful actions condoned or abetted by employees.

In addition, the VbVG provides for the following reasons for mitigation:

1. the association has already taken precautions to prevent such acts or has encouraged employees to behave lawfully prior to the offence;
2. the association is only responsible for offences committed by employees (not by decision-makers);
3. the association has contributed significantly to revealing the truth;
4. the association has compensated the consequences of the offence;
5. the association has taken significant steps to prevent similar acts in the future;
6. the offence has already resulted in serious legal disadvantages for the association or its owners.

Because of these reasons, it is interesting for companies to establish a whistleblowing place in order to be able to take action before criminal authorities start investigations. If there is no separate spot, whistleblowers will submit information directly to external authorities, i.e., supervisory authorities (money laundering reporting office, auditors' supervisory authority, federal competition authority, etc.). At that moment companies normally can no longer take timely measures before criminal authorities begin official investigations.

In connection with the implementation of internal whistleblowers places authorities discuss whether the consent of the employees or the employee representative (if there is one) must be obtained in advance for the establishment of an internal whistleblowing spot. Several parties require a clarification by the legislator in this regard.

Potential solutions 

Failure to set up an "internal" office is not explicitly punishable. This fact - at least regarding the current draft of the HSchG - indicates the legislator's intention. Apparently companies should be relatively flexible in establishing whistleblowing systems.

For medium-sized companies, it makes sense to appoint external service providers (e.g., law firms) as their whistleblowing system. On the one hand, the associated personnel and technical costs can be minimized. On the other hand, due to the corporate structures in medium-sized companies - in which all employees regularly know each other - it is de facto impossible to guarantee the anonymity of whistleblowers; for instance, if only a small number of people have access to the information necessary for the whistleblowing.

By using external service providers, the risk of violating the HSchG, for example in the handling of whistleblowing, can be eliminated. Violations of the HSchG in connection with whistleblowing (obstruction, intimidation, retaliation, and breach of confidentiality) and the treatment of this information are - in contrast to the failure to set up an internal place - punishable by a (substantial) fine of up to EUR 20,000, in repeated cases up to EUR 40,000.