Draft Austrian Whistleblower Protection Bill: first questions

In this episode Magdalena Ziembicka and Anna Schwamberger discuss the recently published Austrian Whistleblower Protection Bill draft and address questions surrounding it.

For queries regarding this episode and our Wolf Theiss Arbeitsrecht podcast, please contact arbeitsrecht@wolftheiss.com.

Episode Summary

The Whistleblower Protection Bill, published by the Austrian parliament on 03 June 2022 implements the EU Whistleblower Directive 2019 on the protection of persons who report breaches. The draft law is under review until 15 July 2022.

Scope of the bill
The draft law coversa wide range of persons who have obtained information about violations of law in their professional capacity. The professional capacity includes employees, applicants, self-employed persons, freelancers and business partners. This encompasses those persons that may suffer economic disadvantages as a result of their whistleblowing actions. At the same time, the economic relationship is not a mandatory requirement as long as the information about violations was obtained in a professional context.

The law applies only to certain areas, the protection of which is in the public interest. This includes financial services, prevention of money laundering, product and food safety, environmental protection, public health, data protection and corruption.

Internal and external reporting channels
Companies employing 250 people or more will have to set up internal reporting channels within six months after the law comes into force. Companies employing between 50 and 249 people will have the time until December 2023 to do so.

External reporting channels, such as the Federal Office for Prevention and Combating Corruption, will also provide reporting channels to persons willing to report violations.

Conditions for protection
In addition to being covered by the scope of the bill, for a whistleblower to receive protection she or he must use established internal or external reporting channels. The person must also display good faith at the time of making the report, meaning that both the reported information and the resulting infringement must be objectively comprehensible and plausible on the one hand, and subjectively believed to be true by the reporting person on the other hand. Furthermore, it must be objectively arguable that the whistleblower and their report fall under the scope of the bill. On these conditions the whislteblower receives protection from the moment the report is filed, even if the information turns out to be inaccurate or false after an investigation.

Whistleblower identity protection
One of the core provisions of the draft law is the protection of the whistleblower’s identity. The identity of the whistleblower may only be disclosed for the purposes of judicial or administrative proceedings if it is indispensable and proportionate for these proceedings and only after the authorities have notified the whistleblower about the need for such disclosure.
This protection of identity disclosure overrides the right of access to personal data by data subjects under Article 15 of the GDPR.

Anonymous reporting
The current draft law states that anonymous whistleblowers also enjoy protection under the same conditions as other whistleblowers. However, in practice it may be possible that internal reporting channels do not allow for anonymous reporting. In any case, our view is that an anonymous report must be processed in the same way as other reports.

What companies will need to do
• Establish an internal reporting channel, which will either comprise of one or more individuals, or will be set up as a separate unit with sufficient personnel and financial resources
• Ensure that persons working in those internal reporting offices act in an impartial and unbiased manner
• Ensure confidentiality, identity protection and data protection related to whistleblower reports
• Provide employees with access to clear information about internal and external reporting channels
• Adjust already existing whistleblowing systems to comply with the law provisions or replace them with other systems in line with the new requirements.

Responsibilities of internal reporting channels
• Check the validity of and follow up every tip-off, which falls within the scope of the law
• Acknowledge the receipt of the report within seven days of filing
• Inform the whistleblower on the follow-up measures, either already taken or planned, or the reasons why the report has not been followed-up, within three months of the receipt of the report.

Prohibition of retaliation measures
The list of prohibited retaliation measures in the draft law is largely in line with the EU directive and covers suspensions, terminations, non-renewal of fixed-term contracts, issues of a bad service report and a disciplinary action. A novelty in the labour law context is the possibility of administrative fines for companies in the amount of up to €20,000.
In cases of retaliation measures that are (fully or partially) irreparable, such as mobbing, discrimination or defamation, the draft law not only imposes an obligation to rectify suffered damage to the reporting person, but also provides for a compensation for whistleblower’s pecuniary damages and for the personal damage suffered. Furthermore, both the directive and draft law provide for an easing of the burden of proof for a causal link between the whistleblowing reporting and a retaliation measure.

The role of works council
The draft law does not mention whether or not works councils must be involved in the introduction of internal reporting channels. Therefore, companies should observe other existing laws and case law.
Based on the existing case law, it was assumed that a conclusion of a works agreement is necessary prior to establishing a whistleblowing hotline, because there is a risk of affecting employees’ dignity in case of such measures. However, in case of internal reporting channels, there is a risk that a works council would refuse to conclude a works agreement and unilaterally veto a measure. Thus, they will be impeding the company to comply with the law. The solution could be to argue that the Whistleblower Protection Bill already contains very extensive protective measures for individuals and therefore, there is no risk of affecting employees’ dignity. However, it will depend on the design of each internal channel and will have to be assessed on a case-by-case basis.