Whistleblower protection in Austria: only a working draft so far

It is already too late: 17 December 2021 is the deadline for EU member states to transpose the EU Whistleblower Directive into a national law.

So far, however, only Denmark, Sweden and Portugal have enacted a national law. Germany still wants to present a draft by the end of the year - time is running out.

Austria is also behind schedule and has not met the deadline. One reason for this is probably the political disagreements in the country: many points are still unresolved.

Unresolved issues

The EU directive is intended to create protection for whistleblowers who report wrongdoing in companies and public authorities. Organisations with more than 250 employees must set up whistleblower reporting channels. Organisations with 50 or more employees are to follow later.

Austria has already submitted a working draft for national implementation. This draft was quite advanced, but still had gaps in some important points. For example, whistleblower protection should apply to violations of data protection, environmental protection and public procurement law. However, the draft leaves open whether the regulation should also apply to criminal law on corruption. The EU Directive makes no statement on this.

Internal before external

Otherwise, the Austrian draft closely follows the EU Directive. According to the draft, whistleblowers are only protected if they assume that their information is true. If, on the other hand, they make "manifestly false" or "misleading" reports, the protection lapses.

The sequence is internal before external: Whistleblowers should first report to internal reporting offices. Only if that would not be reasonable, they may also report to external bodies.

In exceptional cases, they are even entitled to report directly to the media. However, this is only permissible if there is otherwise a danger that evidence will be suppressed, or an emergency situation exists.

In this way, the legislator wants to prevent whistleblowers from directly contacting the media. Instead, companies are to be given the chance to uncover and remedy grievances internally. This can prevent reputational damage that could possibly threaten the existence of the company.

Fines

Violations of the regulations are punishable by fines. For example, if a company uses retaliatory measures such as dismissals, salary reductions or disciplinary measures against whistleblowers, it faces fines of up to 20,000 euros. In the case of a repeat offence, the fine can be up to 40,000 euros.

Whistleblowers should also be protected in cases of bullying, damage to reputation or discrimination. The penalties also apply if whistleblowers are obstructed or put under pressure when reporting. Conversely, whistleblowers also face legal consequences if they "knowingly make false or misleading" reports.

The exact penalties imposed by the states are up to them. A draft law in Poland, for example, provides for prison sentences of up to three years for violations. Poland's draft law also goes beyond the EU requirements in many other respects.

Outlook

The Austrian draft largely only provides for the minimum requirements of the EU Directive. Germany, however, has announced that it will go beyond the EU requirements.

German companies should also look at the national transpositions of the Directive in other countries. Especially if they do business in these countries, especially if they have a branch office there.

It is not yet clear when the final Austrian draft will be presented. According to the plan, the law should come into force at the beginning of next year. However, in view of the delays and review obligations so far, it is too late for that.

Nevertheless, until a national law comes into force, the courts will probably follow the EU Directive closely. Either way, companies should make efforts to set up a digital whistleblower system as soon as possible.