Experts recommend businesses adopt internal investigative systems ahead of whistleblower law

Whistleblower series: Austria

With Austria expected to pass a whistleblower protection law no later than December 2021, legal experts here are recommending that businesses carefully monitor the legal situation and start putting internal investigative systems in place to prevent, detect and respond to reports of misconduct.

Although Austria is now obliged to pass a whistleblower protection law within the next two years in line with a recently passed EU Directive (2019/1937), Austrian courts already preside over misconduct cases as they pertain to violations of Austrian labour law. One reason for this may also be the new sensitivity in HR-cases for data protection issues.

As there is an increasing sensitivity as to whether documentary evidence is obtained in compliance with GDPR and other regulations, businesses are advised to create systems that allow for comprehensive ad hoc investigations.

The first thing Austria-based businesses must realise is that they are legally bound to respond to any and all allegations of misconduct as part of their obligation to create a safe and secure working environment for employees.

How should a business respond if an employee reports misconduct? According to the EU Directive, if no mandatory reporting or investigative systems are in place in the firm, the whistleblower will be compelled to appeal to an outside authority (e.g. police, ombudsman, prosecutors) or might even go public with the allegation as a last resort. In these cases, businesses, at least those which are obliged to establish such systems under the EU Directive, must do everything in their power to protect these whistleblowers, no matter the substance of the allegation.

If a business has an internal system in place, management should respond to an allegation by interviewing the personnel involved. Above all, the interview process should be confidential, both to protect the privacy of individuals (particularly in cases were the allegations are unfounded) and the integrity of the inquiry.

Once interviews are under way, companies will almost always have interactions with their Works Councils, which are in-house employee committees that represent worker rights and usually exist in Austrian businesses with five employees or more. During an investigation, a Works Council representative will likely demand access to all information on the inquiry and participation in any employee interviews.

Managing directors should be aware that the rights of council reps during an ongoing ad hoc investigation are limited. Although these councils have the right to give input on general policies concerning a firm's work environment, they have no general legal right to represent individual staff members without their consent or obtain any information.

In the interview process, businesses should also be aware that the storing of digital records and transcripts has GDPR implications. Data protection officers should be consulted about how evidence is processed.

If an employee is under internal investigation, a business faces the thorny question of what do with the individual before the inquiry is concluded. The decision to terminate or dismiss a person should be well-considered and not taken prematurely, given the high level of protection against unfair dismissal. Yet it is unwise to allow someone under investigation to remain in their position with the power to manipulate evidence or intimidate witnesses.

Under Austrian labour law, employees enjoy the “right to work” only in exceptional cases. Hence, businesses are rarely obliged to keep the subject of an investigation in the workplace as long as the staff member is being paid. As a result, many businesses solve the problem of what to do with a staff member under investigation by sending this employees on fully paid "garden leave", where he is instructed to go home until further notice and to be on call for questioning.

Aside from interviews, internal systems can include other investigative techniques, such as the hiring of private detectives, which has been accepted by courts in past misconduct cases so long as investigators do not overtly violate the privacy rights of a worker. For example, justices frown upon investigators employing round-the-clock surveillance.

Phones, laptops and email accounts of employees can also be sources of evidence. Both Austrian labour law and the GDPR allow for searches of professional email accounts and work-related documents, although businesses are advised to warn employees of the possibility of such searches when they are hired or seal agreements with Works Councils.

Austrian courts have in the past even allowed searches of private emails of employees, but only under controlled circumstances, such as searches using key words pertinent to a case.

Experts advise, however, that the best method of dealing with misconduct is to prevent it from happening in the first place. Firms are encouraged to conduct risk analyses to determine those areas of the business most vulnerable to misconduct and to put policies in place to discourage it.

Businesses can also install whistleblower hotlines, assign personnel to act as reporting officers for allegations of misconduct and draft codes of ethical conduct. In terms of both conduct and reporting, management should show a firm commitment to the process. Leadership can set a tone that infuses and inspires the entire organisation.

Also, periodic training sessions on acceptable behaviour can make a company's standards crystal clear to all employees.

When putting any pro-active system in place, managing directors are encouraged (and sometimes obliged) to cooperate with their Works Councils, and such cooperation can only have a positive influence on corporate culture.

Companies, however, should be aware of the national whistleblower legislation that is expected to come down in the next two years. In the meantime, when crafting whistleblower policies, businesses are encouraged to study the recently issued EU Directive.

For more information on setting up internal investigative systems in Austria, you can consult this short informational webinar. If you have further questions, contact your regular CMS source or local CMS experts: Daniela Krömer and Miriam Mitschka.