What does the whistleblower protection act bring us ?
Aftr a delay of just over a year in the Austrian implementation of the Whistleblowing Directive, which also resulted in treaty infringement proceedings initiated against Austria by the EU Commission, the Whistleblower Protection Act ("HSchG") entered into force on 25 February 2023.
Since whistleblowers are often confronted with none too insignificant disadvantages, they sometimes do not make a report for fear of reprisals. The HSchG is intended to counteract this and to offer potential whistleblowers an opportunity of disclosing internal grievances which take the form of violations of law in the course of employment under legally protected conditions and guarantees.
The HSchG will only protect whistleblowers if they report violations of law from those legal areas which are explicitly mentioned in the act. These can be criminal acts (such as bribery/corruption offences), or legal violations in the contexts of finance or public health. Since violations under employment law (e.g. provisions of the Working Hours Act) are not mentioned by the HSchG, such violations are not covered by the scope of protection of the act.
Which enterprises have to set up internal hotlines?
Enterprises or legal entities under public law with 50 or more employees are obliged to set up internal reporting systems. Enterprises with 250 or more employees must set up such a reporting system within six months of the provision coming into force (i.e. by 25 August 2023). Enterprises with fewer than 250 employees must set up such a reporting system by 17 December 2023.
what do enterprises have to consider?
Enterprises will be required to set up an internal reporting unit within their organisation. This unit can either be set up directly on their premises or may be outsourced, such office then acting as an "internal reporting unit" on behalf of the enterprise. Legislation stipulates that whistleblowers should primarily turn to internal (and not external) bodies.
Enterprises are largely free to decide the (technical) form of the reporting units, i.e. whether this should be implemented via a web interface or in the form of a hotline. However, certain requirements must be considered in the implementation; this includes the fact that the identity of the whistleblower must be kept confidential, or that the employees of the reporting unit are not subject to instructions to enable them to be impartial.
Which rights do whistleblowers have?
Whistleblowers who have reported a grievance must be given confirmation in writing, stating that the report was received, within seven calendar days from the reporting date. Moreover, the internal unit must inform the whistleblower within three months of receiving the report what follow-up measures the internal unit has taken or intends to take or why the internal unit has not followed up on the report.
If whistleblowers complained legitimately, they should also enjoy the full protection offered by the HSchG. Measures against whistleblowers such as suspension, termination of employment, reduction of pay or change of working hours etc. are to be legally invalid; moreover, there is also entitlement to damages.
Sanctions under the HSchG
If a complaint discloses information known to be false or if whistleblowers are prevented from reporting, pressured or retaliated against, administrative fines of up to € 20,000 (up to € 40,000 in case of repeated offences) may be imposed.
Recommendation
The implementation deadline is approaching. Enterprises (at least those with 50 or more employees) should promptly ensure that the technical and organisational implementation of suitable processes for the proper operation of a whistleblower system is launched and finalised in a timely manner.
Further articles provide information on aspects of whistleblowing under data protection and employment law.
Anna Mertinz and her team will be happy to support you.