What does the Whistleblower Directive do?
Whistleblowing systems are not a new concept in Austria. Some public authorities have had them for several years, including the Office of the Public Prosecutor for Economic Affairs and Corruption, the Financial Market Authority, and the Federal Competition Authority. Whistleblowers can report legal violations anonymously online, and the authorities can subsequently contact them. Before the Council of the European Union adopted the Whistleblower Directive on 7 October 2019, private companies were not generally required to have a whistleblower system, although some did have one as part of their compliance structure in recent years.

The Whistleblower Directive now requires companies with at least 50 employees, or an annual turnover of at least EUR ten million, to set up internal processes to receive confidential whistleblower reports. Even flat organizations with open door policies for employees, who have previously relied on a reporting system “based on trust,” will have to institute measures that are more official. Municipalities with more than 10,000 inhabitants are now also required to have a whistleblower system. Keeping the whistleblower’s identity secret is the highest priority.

Companies can choose the type of whistleblower system they want to implement, as long as they keep the whistleblower’s identity confidential. Whistleblowers should be able to submit reports by post, complaint mailbox, online platform (intranet or internet), or telephone hotline.

EU Member States now have two years to implement the Directive.

What can be reported?
The Whistleblower Directive sets minimum standards to protect employees who report violations of EU law concerning: public procurement, antitrust, money laundering, product and transport safety, environmental protection, public health, consumer protection, data protection, etc. It also encourages Member States to adopt an even wider scope when passing national legislation to implement the Directive. It will be interesting to see whether the Austrian legislature decides to embrace this impetus, although it seems unlikely that Austria will adopt a “gold-plated” version of the law. Nonetheless, it could provide an opportune moment to expand whistleblower protections to employees who report violations of national law, for example in the area of antitrust.

How are whistleblowers protected?
The name states the mission: “Directive to protect persons reporting violations of EU law.” Employees who report violations should not have to fear employer retaliation. According to the Directive, retaliation includes measures such as dismissing the employee, refusing to promote them, or refusing to give them a job reference. It also includes measures that are not purely internal, such as “blacklisting” whistleblowers, by formal or informal agreement within the industry, so that they cannot obtain future employment. The goal is to protect the employee from negative consequences, in the event their identity is revealed.

Whistleblowers are protected only if, at the time they report the violation, they could reasonably believe that their assertions are true, and the facts fall within the scope of the Directive. Concerns were continually raised while the Directive was being developed, that employees might abuse the whistleblowing system and use it to spread anonymous falsehoods about their colleagues. However, such employees would not be protected under the Directive, rendering such fears unwarranted.

What are the next steps?
The two-year implementation deadline may seem far off now, but companies should make sure they will be ready when it arrives. Companies that do not already have established compliance structures should particularly take note and get the process underway. Besides deciding on the type of whistleblower system, the company must also determine who will administer it. Depending on the size of the company, it may be the board of directors or management, the compliance officer, the legal department, or the human resources department. Over the next two years, employees should be trained on company compliance matters and the whistleblower system, including how it works and why it’s important. There’s no time like the present to get on board with implementing the new Whistleblower Directive.