The EU Whistleblowing Directive and its implementation in Austria through the Whistleblower Protection Act (HSchG)
With Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law (the "Whistleblowing Directive"), the European Union has for the first time established uniform minimum standards for the protection of whistleblowers. The aim of the Directive is to protect individuals who, in a work-related context, become aware of and report breaches of law, from detrimental treatment and retaliation, and to ensure the effective enforcement of Union law.
Whistleblowers are individuals with specialized knowledge who report specific legal violations, grievances, or other organizational deficiencies in public administration or private companies, with the aim of promoting their clarification or preventing them from occurring in the first place.
The Whistleblowing Directive covers reports of breaches of Union law in a wide range of areas. These include, in particular:
The directive explicitly provides that Member States may extend the material scope. This gives national legislators the opportunity to include additional areas within the scope of protection.
The personal scope of the directive is broad. Protection is afforded to all persons employed in the private or public sector who have obtained or acquired information on breaches in the course of their professional activities. In particular, the protection covers:
A direct contractual relationship between the whistleblower and the organization concerned is not required. What is crucial, rather, is that the information was obtained in a professional context.
A prerequisite for protection is that the whistleblower had reasonable grounds to believe, at the time of reporting, that the information reported was true. The directive thus protects honest whistleblowers and not individuals who knowingly disseminate false information.
A key objective of the directive is to protect whistleblowers from retaliation. Therefore, all retaliatory measures taken in response to a report are expressly prohibited.
Retaliatory measures include, but are not limited to:
Furthermore, the directive obliges member states to provide support measures for whistleblowers and to introduce effective sanctions against individuals who obstruct reporting, intimidate whistleblowers, or engage in retaliation.
A core element of the directive is the obligation to establish secure and confidential reporting channels, which include both internal and external channels.
Internal reporting channels are established within companies or organizations and are intended to give whistleblowers the opportunity to report legal violations internally first. External bodies can include, in particular, ombudsman offices or government authorities, as well as the press or the internet.
In principle, an internal report should be made first. However, direct reporting to an external body is permissible if, for example, no internal reporting system exists or the whistleblower fears retaliation.
The responsible bodies are obliged to examine incoming reports and to inform the whistleblower about the follow-up measures taken within specified deadlines.
The EU Whistleblowing Directive obliges companies and public entities to establish internal reporting channels. Companies with more than 250 employees, as well as municipalities with more than 10,000 inhabitants, had to implement corresponding systems by December 17, 2021. For companies with 50 to 249 employees, an extended implementation deadline applied until December 17, 2023.
Special provisions apply to corporate groups: Group companies with 50 to 249 employees can use shared reporting channels under certain conditions. However, this option does not exist for companies with more than 249 employees; they must establish their own internal reporting channels.
The Whistleblowing Directive had to be implemented by December 17, 2021. In Austria, the Whistleblowing Directive was implemented with the Federal Act on Procedures and Protection for Reporting Violations of Law in Certain Legal Areas (Whistleblower Protection Act - HSchG). The Act came into force on February 25, 2023.
The Austrian legislator has made use of the possibility to extend the scope beyond the minimum requirements of Union law. The HSchG therefore covers not only violations of Union law but also violations of national law in the areas mentioned in the Directive. Furthermore, corruption offenses according to §§ 302 to 309 of the Criminal Code (StGB) were specifically included in the scope.
However, violations of labor law provisions are not included.
The HSchG protects individuals who have obtained information about legal violations due to a current or former professional connection to a private or public sector entity, in particular
A prerequisite is that the information was obtained in a professional context and constitutes insider knowledge that is usually not accessible to outsiders.
Furthermore, the HSchG also protects certain individuals connected to the whistleblower, such as works council members, employee representatives, colleagues, or close relatives, provided they could be affected by indirect retaliatory measures.
Protection begins as soon as the report is submitted, provided the whistleblower could reasonably assume at the time of reporting that their information is accurate and falls within the scope of the law.
Protecting the identity of all involved parties is of particular importance. The identity of whistleblowers and their personal data must generally not be disclosed. Disclosure is only permissible within the scope of administrative or judicial proceedings and requires a careful balancing of interests between the seriousness of the allegations and the whistleblower's need for protection.
Legal entities under private and public law, as well as registered partnerships with at least 50 employees, are obliged to establish internal reporting channels.
The following deadlines applied for implementation in Austria:
Associations and non-profit organizations are also covered by this obligation, provided they meet the legal requirements.
However, the HSchG does not provide for immediate sanctions for the mere failure to establish an internal reporting system.
For reporting channels to effectively fulfill their duties, they must, in particular, have
have.
In addition to written reports, oral communication channels must also be offered. At the whistleblower's request, a personal meeting must be made possible within 14 days.
Furthermore, the following procedural deadlines apply:
If no measures are taken, this must be comprehensibly justified to the whistleblower. Reports outside the scope of the HSchG or tips without sufficient evidence of their validity do not have to be pursued further.
The central external reporting office in Austria is the Federal Bureau of Anti-Corruption (BAK).
Depending on the legal area concerned, other authorities may also be responsible, such as
Reports to competent bodies of the European Union also fall within the scope of protection of the HSchG.
According to § 9 HSchG, all incoming reports and follow-up discussions must be documented. Whistleblowers must be given the opportunity to review the documentation, correct it if necessary, and confirm its accuracy.
Additionally, employers are obliged to provide their employees with clear and easily accessible information about the existing reporting channels and the corresponding procedures.
The HSchG declares measures taken in response to a legitimate report to be legally invalid.
These include, in particular:
Affected whistleblowers can claim damages and demand the restoration of the lawful state. If this is not possible, there is a right to appropriate compensation.
To enforce legal requirements, the HSchG stipulates administrative penalties of up to EUR 20,000. For repeat offenses, fines of up to EUR 40,000 may be imposed.
Offenses include, in particular:
Whistleblowers themselves can also face administrative penalties if they knowingly make false reports. The penalty here is also up to EUR 20,000, and for repeat offenses, up to EUR 40,000.
Furthermore, a knowingly false report that includes an accusation of a criminal act to be prosecuted ex officio or a violation of official or professional duties, if made with the intent to expose another person to the risk of official prosecution, may be criminally punishable as defamation (§ 297 StGB). The penalty in this case is generally imprisonment for up to one year or a fine of up to 720 daily rates; however, if the falsely attributed act is punishable by imprisonment exceeding one year, the penalty for defamation imprisonment from six months to five years.
The Criminal Code, however, also includes the ground for exemption from punishment based on active repentance (§ 297 Abs 2 StGB).
