On 25 February 2023, Austria’s Whistleblower Protection Act (Act) entered into force. The Act transposes the EU Whistleblowing Directive (Directive 2019/1937/EU; ‘Directive’) into Austria’s national law, setting forth a slightly extended material scope against the minimum requirements of the Directive.
This is the first in a series of blogposts exploring both legal and practical whistleblowing issues to be considered by companies operating in Austria and provides for a short summary of the key provisions of the Act.
Personal scope
The Act aims to encourage lawful conduct in areas of particular public interest by providing for easy and predictable procedures for reporting related breaches. Therefore, it sets out rules for the protection of whistleblowers, and persons close to them (e.g. facilitators, colleagues, relatives), same as the Directive.
The Act remains loyal to the Directive and only applies to whistleblowers who acquire information on a relevant breach in a work-related context. It does not apply to ordinary complaints by customers or citizen bystanders.
The Act requires enterprises to operate an internal whistleblowing system in compliance with certain minimum standard requirements if the company:
- has at least 50 employees with their usual place of work in Austria or
- regardless of the number of the employees, is subject to sector-specific or other whistleblowing laws (e.g. entities subject to financial services and financial markets regulators, anti-money laundering legislation as well as civil aviation and safety of offshore oil and gas operations related provisions).
Timeline
Any steps necessary for the implementation (or updating) of a reporting system, including the amendment of any works council agreement, if applicable, must be implemented by 25 August 2023 in case of companies with at least 250 employees, or by 17 December 2023 in case of companies with 50 to 249 employees.
Material scope
The material scope of the Act goes beyond that of the Directive given that it covers reports on breaches against both EU law and national Austrian law in the legal areas listed by the Directive as well as certain violations of Austrian criminal law such as bribery.
A possible extension of the material scope of the Act is not expected before the next ministerial evaluation of the Act that is scheduled for 2026.
Encouragement of the use of internal reporting vs. external reporting
The Act, just like the Directive, explicitly encourages whistleblowers to submit their initial report via internal channels of the company, but simultaneously allows for initial reports to be submitted to external channels established at the competent authorities. The default external channel will be established at the Federal Bureau of Anti-Corruption (Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung). For reports on breaches in certain legal areas, the specialised units already established shall remain competent, e.g. the Austrian Financial Intelligence Unit (Geldwäschemeldestelle) or the external reporting channel of the or the Federal Competition Authority (Bundeswettbewerbsbehörde).
In light of the Act and the Directive, companies are thus advised to promote their internal whistleblowing systems as efficiently as possible and to make these channels as easily accessible as possible (while, at the same time, not impeding external reporting lines). This is recommended also with a view to the managements’ general liability, given that in the current legal framework, a manager risks becoming liable to damage claims if he fails to establish an effective whistleblowing system as part of the company’s compliance structure, where adequate. A task that is truly easier said than done, as it must be carried out in compliance with the respective legal requirements and also should take into account cultural peculiarities - in particular in Austria, where whistleblowing systems are still seen with scepticism and a fear of:
(i) facilitating unfounded or unjust allegations –the Act itself explicitly addresses this issue in its very first section and provides for administrative penalties for persons who knowingly submit false reports – and
(ii) concerns that whistleblowing systems may potentially result in an unhealthy work atmosphere where employees are constantly spied upon and reported on by their colleagues.
An additional reason for companies to promote internal reporting channels is that external reports may result in investigations by the respective authorities, unwanted publicity in the media or even the loss of certain legal options such as the possibility to apply for leniency witness status in anti-competition proceedings. Details of the Federal Bureau of Anti-Corruption’s competencies remain to be seen, as the respective reporting channel is still being established.
Whistleblower protection
The Act, just like the Directive prohibits, penalises, and declares legally invalid any retaliatory actions against whistleblowers. Examples of such actions include terminations of employment, denied promotions, bad performance reviews, changes to an employee’s work responsibilities and many more.
A whistleblower further benefits from a reverse burden of proof. In case of a litigation, he or she must merely make a plausible case (but is not required to prove) that an action detrimental to him or her was retaliatory, while it is the employer who must show that the action was motivated by other, legitimate, reasons (e.g. headcount reduction). Companies should therefore thoroughly document their HR decisions and the respective reasonings.
What now?
Companies should review and, if necessary, update their internal reporting systems including all policies connected thereto in accordance with the demands imposed by this new legal landscape.
Watch this space for details of the implementation of EU Whistleblowing Directive! In the meantime, you can read more about the Belgian implementing law here, the German one here, the Italian one here, and the Spanish one here and feel free to reach out to the respective authors for further questions.
