WorkLife 2.0: The impact of Austria’s Whistleblower Protection Act on trade secret protection

This article is the third in a series of blogposts exploring both legal and practical whistleblowing issues to be considered by companies operating in Austria. It provides for a short summary of the potential key implications of the new rules on the protection of trade secrets. The previous blog posts can be read here and here.

While the implementation of whistleblower protection is in fact expedient in order to successfully detect violations or irregularities in public or private organisations, it bears the risk of violating an immensely important legal asset: the organisation's trade secrets.

Whistleblower protection in connection to trade secrets - What's new? 

Reconciling the protection of trade secrets and whistleblower protection can be tricky. In Austria, trade secret protection is mainly implemented by the Austrian Act Against Unfair Competition (UWG), which transposes the European Directive on Trade Secrets (Directive 2016/943/EU). 

The UWG includes a ‘whistleblower exception’, meaning that it sets out the requirements under which an acquisition, use or disclosure of trade secrets by whistleblowers is considered lawful.

The new provisions of the Whistleblower Protection Act (HSchG), now apply in addition to the existing regulations but with a slight difference: 

The UWG provides that the acquisition, use or disclosure of trade secrets is lawful when the whistleblower’s intention is to reveal actual unlawful acts in relation to professional misconduct (‘beruflichen Fehlverhalten’) or illegal activity in connection with a trade secret, provided that the whistleblower acted for the purpose of protecting the general public interest.

By contrast, the liability exemption under the HSchG provides for somewhat less stringent requirements:

According to the HSchG, a whistleblower’s liability for the disclosure of trade secrets shall be excluded if the whistleblower has sufficient reasons to believe that the information:

• is true;
• falls within the scope of the HSchG; and 
• is necessary to detect or prevent a violation or irregularities of the laws within the scope of the HSchG (including areas of EU law and Austrian law, as well as certain violations of Austrian criminal law such as bribery).

Hence, the HSchG does not require the whistleblower's intention to protect the general public interest, in order to grant protection to the whistleblower.

The recitals of the Whistleblowing Directive indicate that the EU legislator intends to protect the bona fide whistleblower. Because of this and of the less stringent requirements in the Austrian HSchG, in practice it will be the case that – when it comes to trade secrets – a report that falls under the HSchG will remain privileged, even if disclosure would not (yet) be permissible under the UWG. 

However, in practice, uncertainties may arise from the fact that trade secrets are confidential by nature and the HSchG only provides for an exemption from liability and confidentiality obligations if disclosure is ‘necessary’. 

German law implementing the Whistleblowing Directive also provides for a similar wording as that of HSchG. Therefore, it remains to be seen how Austrian and German courts will construe this wording.

Who is protected? 

The HSchG grants protection from liability for factual or legal consequences of their report to whistleblowers, as well as to persons within the whistleblower’s circle, e.g. legal entities that the whistleblower owns, works for or is otherwise connected to, within a work-related context, or third persons who are connected with the whistleblower and who could suffer retaliation in a work-related context, such as colleagues or relatives of the whistleblower. However, it remains yet to be seen how this protection will be interpreted by the courts to the benefit of legal entities, such as the whistleblower’s employer. In this context, the HSchG leaves the question open, as to whether the protection for the employer of a whistleblower also covers a breach of confidentiality obligations of the employer (e.g. if the employer is bound by a confidentiality agreement concluded with another company or a third party). 

Restrictions regarding the use/disclosure of trade secrets by public authorities and external whistleblowing reporting channels

The Whistleblowing Directive and the HSchG provide for several restrictions on the use/disclosure of trade secrets by public authorities/external whistleblowing reporting channels.

First, the Whistleblowing Directive requires member states to ensure that competent authorities receiving information on breaches including trade secrets do not use or disclose trade secrets which they have learnt in the context of a whistleblowing report for purposes going beyond what is necessary for a proper follow-up to that report. To this end, the HSchG provides that authorities may use and disclose trade secrets received from whistleblowers only to the extent necessary for e.g. assessing the accuracy of the report and preventing or prosecuting the breaches reported.

Furthermore, the HSchG provides that external whistleblowing reporting channels shall not follow up on reports which:

• do not fall within the scope of the HSchG,
• only relate to clearly minor breaches within the scope of the HSchG, 
• are unsubstantiated, or 
• constitute mere repetitions of previous reports. 

Obviously false information must be rejected. Reports that fall within the responsibility of other authorities must be forwarded to those competent authorities and the whistleblower shall be informed accordingly. More details on the respective internal guidelines of such authorities, e.g. for the default external whistleblowing reporting channel in Austria can be found here: LINK. 

In case of subsequent court proceedings, concerning an infringement of a trade secret, the protection of such trade secret applies (e.g. the possibility to request the court to ensure that any opposing or third parties do not receive any information about the trade secret that exceeds their previous level of knowledge).

Importance of maintaining a state-of-the-art internal whistleblowing system

On a final note, within the EU, trade secrets are generally defined as information that is secret, of commercial value and is protected by ‘reasonable steps’. The implementation of an internal whistleblowing channel could be considered as one of such reasonable steps. This begs however the question whether, e contrario, not establishing a state-of-the-art whistleblowing system could result in the risk of losing the statutory protections for a companies’ trade secrets. In practice, the answer to this question will depend on a case-by-case analysis, taking into account in particular what other protective measures have been implemented and whether the HSchG requires the company to maintain an internal whistleblowing channel. 

What now?

In principle, the protection of trade secrets still applies but the HSchG has significantly elevated the level of whistleblower protection in Austria also in case of trade secrets disclosures. 

Against this background, trade secret protection policies in Austria should take into account in particular that:

1. whistleblowers may be permitted to disclose trade secrets to external parties within and outside the scope of the HSchG,
2. public authorities and whistleblowing reporting channels receiving trade secrets from whistleblowers are subject to several restrictions; and
3. whistleblowers’ employing entity may qualify for additional protections under the HSchG if confronted by retaliatory acts. 

Apart from the importance of reporting violations under the HSchG, certain measures should be taken to protect trade secrets: 

• Internal whistleblowing channel: As mentioned above, the implementation of an internal reporting channel could be a way to protect trade secrets from being leaked to the public. 
• Briefing and informing employees: Employees should be aware of what information and to which extent it may be disclosed and what options with respect to the reporting channel (internal/external) are available. 
• Limit access: Companies should implement detailed policies and protocols that identify and protect trade secrets, and sharply limit access to them.