The internal reporting channel duty in Austria

2023-02-25 (the day after publication, section 28(1)). Section 28(1) also grants a six-month transitional period for setting up internal and external channels, so entities with 250 or more employees had to have a channel in place by 25 August 2023.

§ 3 Abs 2 HSchG names no Austrian federal act at all. Its full text is: "Ohne Rücksicht auf die im Abs. 1 genannte Anzahl der Arbeitnehmerinnen, Arbeitnehmer oder Bediensteten, jedoch nur nach Maßgabe des § 4 Abs. 1 bis 3, gilt dieses Bundesgesetz im Bereich der Vorschriften, die in den Teilen I.B und II des Anhangs zur Richtlinie 2019/1937/EU aufgezählt sind." It is a bare cross-reference to Parts I.B and II of the Annex to the Directive. The list of 18 named federal acts is § 4 Abs 1 Z 1-18, and § 4 Abs 1 is a subsidiarity rule (the HSchG applies only insofar as a matter is not bindingly regulated by those Union acts or not regulated by those federal acts), it is not the provision that removes the headcount threshold. Rewrite as: no headcount threshold for employers within the scope of Parts I.B and II of the Annex to Directive 2019/1937 (§ 3 Abs 2 in conjunction with § 11 Abs 1), subject to the precedence rule in § 4 Abs 1.

17 December 2023. Section 28(2): „Die §§ 11 bis 13 treten hinsichtlich der Unternehmen und juristischen Personen mit weniger als 250 Beschäftigten am 17. Dezember 2023 in Kraft.“ Note the Austrian cut-off is drafted as 'fewer than 250 employees', which also catches employers below 50 that are caught anyway through the section 3(2) sectors.

Not required. The HSchG does not oblige employers to accept anonymous reports or to follow them up, and it does not require channels to be built for anonymous submission. Section 6(3) only provides that anonymous whistleblowers are entitled to protection „wenn als Folge ihres anonym gegebenen Hinweises ihre Identität ohne ihr Zutun anderen bekannt wird“, that is, protection kicks in if their identity becomes known without their doing. Section 4(2)(1) preserves other rules that are more favourable to whistleblowers, expressly including rules on the possibility of anonymous reports, so sector regimes can be stricter.

Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung (BAK) is the general external reporting office for reports concerning private and public sector entities (section 15(1)). Section 15(2) gives precedence to eight specialised bodies where they are competent under their own federal acts, including the Abschlussprüferaufsichtsbehörde and the Finanzmarktaufsicht.

There is no penalty for failing to establish an internal reporting channel. Section 24 lists only four punishable acts: (1) obstructing, or attempting to obstruct, a person covered by section 2 in connection with a report, or pressuring them through vexatious court or administrative proceedings; (2) taking one of the retaliatory measures listed in section 20(1) nos. 1-9 or 20(2) nos. 1-6; (3) breaching the confidentiality protections in sections 7 or 17(1); (4) knowingly making a false report. These are administrative offences (Verwaltungsübertretung) punished by the Bezirksverwaltungsbehörde with a fine of up to EUR 20,000, and up to EUR 40,000 in case of repetition, unless a stricter penalty applies under another provision. Breach of section 11 (the duty to set up the channel) is not listed.

Yes, expressly. Section 13(4): public sector legal persons that are not federal organisational units, and undertakings, may transfer the tasks of the internal reporting office to a joint body, and „Mit den Aufgaben der internen Stelle können auch Dritte beauftragt werden“, third parties may be entrusted with the tasks of the internal office.