Despite much criticism, the Whistleblower Protection Act ("HSchG"), which transposes Directive (EU) 2019/1937 ("Whistleblowing Directive") into national law, was adopted by the National Council on 01 February 2023. The Whistleblower Protection Act obliges companies with 50 or more employees to establish an effective reporting channel (Link zu vorherigen Blogposts?).
What does this mean for my enterprise?
Enterprises must ensure that they set up an "effective" reporting or whistleblower channel which also complies with data protection requirements. The law does not provide any details as to what such a channel should look like – enterprises are therefore encouraged to define internal strategies and processes for the design of their own whistleblower channel.
Apart from setting up this reporting channel, enterprises should also consider how that channel, once set up, will be operated or kept updated! After all:
- each tip-off received must be checked for validity,
- it must be documented accordingly, and receipt must be acknowledged vis-à-vis the whistleblower within 7 days; and
- the whistleblower must be informed about the measures planned, or the reason why the tip-off was not followed up on, no later than 3 months after receipt of the tip-off!
It goes without saying that internal units must act impartially and without bias when receiving and verifying tip-offs and that they must protect the identity of the whistleblower and the person affected by the tip-off accordingly.
What else needs to be considered in the introduction of the channel?
Apart from the provisions of the Whistleblower Protection Act and the data protection requirements which a whistleblower channel needs to meet, enterprises introducing such a channel should also observe the requirements under employment law, in particular the works council’s participation rights. If the whistleblower channel is designed in such a way that it goes beyond the legal requirements of the Whistleblower Protection Act, a works agreement may be necessary (in enterprises where there is no works council, an agreement under sec. 10 of the Austrian Employment Contract Law Adaption Act/AVRAG would have to be signed).
Our Data Protection and Employment Law Teams will be happy to help you set up your whistleblower channel!