Whistleblowing is an important mechanism to uncover and prevent illegal or unethical activities within an organization. To strengthen the protection of Whistleblowers across member states, the European Union adopted the Directive 2019/1937/EU on the protection of persons who report breaches of Union law, which requires all member states to implement certain minimal standards.

Austria’s transposition of the Directive

In Austria, the Directive has been transposed in the „HinweisgeberInnenschutzgesetz – HSchG“, which entered into force on February 25, 2023. The HSchG requires companies with 250 or more employees to establish a whistleblower system as of August 25, 2023, and companies with 50 to 249 employees to do so as of December 17, 2023. This system must, among other things, ensure the confidentiality of the whistleblower’s identity and provide for the possibility to follow-up on the report.

As outlined, legal entities which employ more than 50 employees are obliged to establish an internal whistleblowing system. The threshold of 50 employees applies per legal entity (and not group-wide). As soon as a subsidiary in Austria has more than 50 employees, there is an obligation to set up an internal channel. The HSchG applies to legal entities located in Austria. It makes no difference, if the parent company is located outside the EU, the Austrian subsidiary must still comply with the HSchG in case the threshold is met. If the number of employees fluctuates, the average number of employees in the past year is decisive.

Although the EU Commission is against a group-wide central whistleblowing system at the parent company, the Austrian HSchG explicitly provides for the possibility of a central whistleblowing system for corporate groups. According to the HSchG, third parties may be entrusted with the tasks of the internal channel. Therefore, it is possible to entrust law firms or set up a confidential and independent unit within a group at one of the group companies. This applies regardless of the size of the company. The rights and obligations under the HSchG then also apply to this body. Further, the HSchG does not require the internal system to be set up in an Austrian entity.

However, even though the HSchG allows a central whistleblowing system for corporate groups, companies should ensure their whistleblowing system is easily accessible for their employees and contractual partners and designed to maintain the confidentiality of the whistleblower as well as the integrity of the investigation. While the HSchG does not prohibit the use of shared resources, companies should make sure their whistleblowing system is able to operate effectively and independently. It is recommended that companies establish clear policies and procedures for handling whistleblower reports and allocate adequate resources to support the operation of the system. In addition, companies must ensure whistleblowers have easy access to clear information about the availability of and procedure to make a report to internal and external channels.

The material scope of application of the HSchG is limited to public procurement, financial services, product safety and conformity, traffic safety, environmental protection, radiation protection, food safety and animal health, public health, consumer protection, protection of privacy and personal data, corruption and related criminal acts, as well as reports regarding the protection of the financial interests of the EU and corporate tax law issues.

It is also possible to offer additional reporting categories in the internal reporting system. In such case, it is recommended to include a disclaimer on the reporting intake form that certain categories are not covered by the HSchG and consequently the whistleblower in such cases is not protected by the HSchG in order to clearly inform the whistleblower and provide for legal certainty.

A whistleblower will be protected according to the HSchG if, they have had sufficient reason to believe the submitted report is true and falls within the material scope of the HSchG. Reports made based on hearsay can also be protected under the HSchG, as long as the information is credible and relates to a possible violation within the material scope of the HSchG. In case a report does not fall within the aforementioned scope of application or if there are no indications for its validity, the internal channel does not have to follow up the report.

Besides the implementation of internal reporting systems, the HSchG also requires the establishment of external channels. In principle, the Federal Bureau of Anti-Corruption (Bundesamt für Korruptionsbekämpfung „BAK“) is the external body that would be generally competent in handling these reports. The BAK is currently working on the implementation of a reporting system and is recruiting respective staff. The external system has to be established by August 25, 2023 at the latest. External bodies also have an informing role. They have to explain the provisions of the HSchG, such as requirements for whistleblower protection, the procedure for handling reports, possible follow-up measures etc., in plain language and easily recognizable on their website.

Finally, the HSchG provides for financial penalties. Those who obstruct or attempt to obstruct whistleblowers, violate confidentiality, or knowingly make a false report can be punished with fines of up to EUR 20,000 (or even EUR 40,000 in repeated cases). However, the HSchG does not provide for any sanctions for the failure to implement an internal whistleblowing system.

Final words

In summary, the transposition of the EU Whistleblowing Directive in Austria in the HSchG brought important changes for companies operating in Austria and align similarly to many other countries that have transposed the Directive.

In our opinion, it is essential for companies to establish a state-of-the-art internal whistleblowing system that complies with the requirements of the HSchG to enable confidential reporting. Only this way external reporting can be avoided in the long run. By receiving the information on potential wrongdoings first, the company will not only have a significant advantage in potential (court) proceedings, but also the possibility to implement respective compliance measures to sustainably avoid future misconduct within the organization.

For a deeper dive into the transposition of the HSchG, view our webinar, EU Whistleblower Directive: Latest News – March 2023, featuring Dr. Pilar Mayer-Koukol, Attorney at Law, Paulitsch Law and Jan Stappers, Whistleblowing Specialist, NAVEX.: watch now

Dr. Pilar Mayer-Koukol, Attorney at Law  and Sophia Hinterlechner, Associate