Building trust through clear procedures
The aim of the HSchG is to promote the willingness to engage in lawful behaviour in areas of particular public interest. For this purpose, simple and predictable procedures are created for whistleblowers to report possible legal violations. This not only protects the whistleblowers themselves but also their environment from personal disadvantages.
The Austrian Whistleblower Protection Act does not expressly stipulate that affected companies are also obliged to accept anonymous reports. However, if a report is received from an anonymous whistleblower that falls within the scope of the HSchG, the whistleblower will in any case enjoy the protection of the HSchG. This means that not only whistleblowers who give their name are protected, but also those who provide information anonymously. The Whistleblower Protection Act contains strict provisions on the confidential treatment of the report, the duty of confidentiality and the protection of the whistleblower’s identity.
Obligation to set up an internal whistleblower system
The HSchG requires companies and legal entities under public law with at least 50 employees to set up an internal whistleblower system. An internal whistleblower system allows employees to report violations and grievances confidentially without fear of reprisals. The obligation to set up an internal reporting channel ensures that companies of a certain size establish mechanisms that promote the reporting of misconduct while simultaneously protecting the identity of whistleblowers.
Gaps in the law cause problems with implementation
The Austrian Whistleblower Protection Act (HSchG) largely implements only the contents prescribed by the EU Whistleblower Directive, and the EU itself only has limited powers to mandate harmonizations. As a result, whistleblowers acting outside the substantive scope of the law are not protected by the HSchG. The consequence is that many reports on criminally relevant matters do not fall under the substantive scope of the HSchG. This applies, for example, to the particularly relevant criminal offences in Commercial Criminal Law and tips regarding embezzlement, misappropriation, fraud and breach of trust, which are regularly the subject of whistleblower reports. Employee protection provisions are also excluded from the material scope of the HSchG. Whistleblowers who report an incident in this sense therefore do not fall within the scope of protection of the HSchG under Austrian law. This is an area that can still be developed and will be evaluated by the legislator in 2026 (at the latest) in order to make any necessary adjustments.
Practical Advice: Extend internal whistleblower channel voluntarily
As the material scope of the HSchG excludes many important compliance aspects as described, it is advisable for companies to voluntarily organise their internal reporting channels more broadly than required by law. This applies in particular to relevant core compliance provisions such as criminal law. In plain language, this means that companies can, for example, also allow information on criminally relevant offences such as fraud and embezzlement in their internal reporting channels and also grant whistleblowers the protection to which they are entitled under the HSchG for such information. In this way, companies can strengthen trust in the internal reporting channel and the functioning of the Compliance Management System. A voluntary extension of the scope of application of the internal reporting channel requires a data protection impact assessment and a works agreement (or, in companies without a works council, the consent of the employees).
Deadlines and Implementation
The implementation of the Whistlelower Protection Act is gradual. Companies and legal entities in the public sector with 250 or more employees were obliged to set up an internal whistleblower system by 25 August 2023 at the latest. For companies with 50 or more employees, the legal obligation to set up a reporting channel comes into force on 17 December 2023.
Support from an Ombudsman or Trusted Lawyer
The successful implementation of an effective internal reporting channel requires practical experience and legal knowledge. Many companies therefore seek support from experienced experts – such as specialised law firms – when implementing the internal reporting channel. Specialists can help to set up internal reporting channels and put together a package that is suitable for the company in question, so that the company can also derive added value from the implementation of the legal requirements. Lawyers can not only assist with the legal structure and selection of the appropriate reporting platform, but also ensure that the reporting mechanism guarantees the protection of the whistleblower’s identity and confidentiality as well as data protection obligations. In addition, lawyers are subject to a strict professional duty of confidentiality and can also assist with the legal review of the tip received and with internal investigations.
