Whistleblowing

The Whistleblowing Directive (Directive 2019/1937/EU) sets minimum standards for the protection of whistleblowers and covers various areas. It was originally due to be implemented in all EU member states by 17 December 2021. Austria met this obligation with the slightly delayed Whistleblower Protection Act (HSchG), which was passed by the National Council on 1 February 2023. The law entered into force on 25 February 2023 and aims to provide better protection for whistleblowers.

The law is limited to the mandatory provisions of the Whistleblowing Directive. The aim of this is to minimise the burden on smaller companies. However, the statute provides for a re-evaluation. The content of the Whistleblower Protection Act is very similar to the Directive and barely goes beyond it. It only extends to include crimes related to corruption, already embedded in the Austrian Criminal Code.

The status of whistleblowers in Germany, as in other EU member states, is primarily governed by European law. The relevant legislation is Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons reporting infringements of Union law (EU Whistleblower-Directive).

The German legislature has incorporated the EU-Whistleblower-Directive into German law by enacting the Whistleblower Protection Act (“Hinweisgeberschutzgesetz”) which – largely – entered into force on July 2, 2023.

If the Whistleblower Protection Act (hereinafter referred to as “HinSchG”) should meet specific concerns under European law, this will be pointed out separately in the following.

In Portugal, the law that governs the status of whistleblowers is Law No. 93/2021, which transposed Directive (EU) 2019/1937 of the European Parliament and the Council.

Companies with 250 or more employees and – from 17 December 2023 onwards – companies with 50 or more employees are required to establish internal reporting channels. In addition, certain companies, particularly those in the financial sector, must establish these channels regardless of the number of employees. The obligation also extends to the public sector, including the federal government, provinces, municipalities, chambers and others. External reporting channels must also be established, with the Federal Bureau of Anti-Corruption acting as the primary external reporting body. The Financial Market Authority or the Money Laundering Reporting Office is responsible for the area of financial service providers.

In principle, companies that regularly employ 50 or more employees are obliged to set up an internal reporting system (section 12 (1), (2) HinSchG). For companies with between 50 and 249 employees, this obligation will only apply from 17 December 2023 (section 42 HinSchG).

For certain employers, particularly in the financial and insurance sectors or for data provision companies, the obligation to set up an internal reporting office applies irrespective of the number of employees as of the entry into force of the Act (section 12 (3) HinSchG).   

Legal persons, including the state and other legal persons governed by public law that employ 50 or more employees must implement a whistleblowing procedure. Regardless of the number of employees, entities operating in the sectoral areas referred to in Part I.B and II of the Annex to the EU Directive, including financial services, products and markets, the prevention of money laundering and terrorist financing, transport safety and protection of the environment must also introduce a process. Finally, in the public sector, local governments with 50 or more employees but with less than 10,000 inhabitants are excluded.

Section 13 (4) HSchG provides that third parties may be entrusted with the tasks of the internal reporting channel. The law does not specifically define who such third parties can be, but such outsourcing does not affect the ultimate responsibility of the company or the legal entity to comply with the law.

It is not clear whether a joint reporting channel can be established in corporate groups. In addition to outsourcing to third parties, section 13(4) HSchG also allows the transfer of internal reporting tasks to a joint body. It is questionable whether this provision is in line with the Directive. The European Commission interprets the relevant provision of the Whistleblowing Directive differently. It argues that every company with at least 50 employees must set up its own reporting channel. This question will therefore have to be clarified by the courts.

According to the explanatory memorandum of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG). However, the European Commission has already announced in two statements during the legislative process that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. The question of the compatibility of the regulation with EU law will only arise in practice at a later stage, provided that this question needs to be clarified in court. 

The Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

The law does not specify so, in theory, yes provided that we are referring to the general rules of a whistleblowing procedure.

Please note that all companies with 50 or more employees should establish internal reporting channels, irrespective of the nature of their activities.

Nevertheless, in the private sector, companies with 50 up to 249 employees may share resources with other legal entities as regards the receipt of reports and any investigation to be carried out.

Both companies and whistleblowers can be fined up to 20,000 euro (40,000 euro for repeated offences) per violation. Examples of sanctionable acts include obstructing whistleblowers, retaliation, breach of confidentiality or the deliberate submission of false information.

If there are no whistleblowing procedures in the company (ie, an internal reporting system is not implemented and operated), this constitutes an administrative offence punishable by a fine. This fine may amount to up to 20,000 EUR (section 40 (2) No. 2, (5) HinSchG).

At this point, it should be noted that there is a high incentive for employers to implement an internal reporting channel, since the external reporting channel is available to the whistleblower in any case. Consequently, if an internal reporting office were not implemented or operated, the whistleblower would be forced to report directly to the external reporting office. As a result, the employer would not be able to make internal corrections without the reported information leaving the company.

Entities that fail to establish a whistleblowing procedure will incur a serious penalty, with fines from 1,000 EUR up to 125,000 EUR.

Works Council Agreements (WCAs) can be concluded on general rules that regulate the behaviour of employees in the company. If the introduction of the internal whistleblowing system only reflects the minimum requirements of the HSchG, it does not trigger mandatory co-determination by the works council and no WCA is necessary.

On the other hand, if the company sets up an internal whistleblowing system that goes beyond the minimum requirements of the HSchG, the works council’s co-determination will have to be observed regularly.

The employer must provide the works council – upon request – with information on all matters concerning the economic, social, health or cultural interests of the employees of the enterprise as per section 91(1) of the Austrian Labour Constitution Act (ArbVG). In addition, the employer must inform the works council of the types of personal data of employees that he collects using automated systems and of the processing and transmission that he intends to carry out. Upon request, the works council must be allowed to verify the basis for the processing and transfer – section 91(2) ArbVG.

Although the implementation of a whistleblower system is based on a legal obligation, the works council only has to be involved under certain circumstances.

At first, the employer is, in principle, already obliged to inform the works council in good time and comprehensively about everything it requires to carry out its duties. This information requirement should enable the works council to review whether co-determination or participation rights exist or whether other tasks have to be carried out according to the German Works Constitution Act (BetrVG).

For instance, instructions concerning the orderly conduct of employees are subject to co-determination. These instructions are intended to ensure an undisturbed work process or to organise the way employees live and work together in the company.  If, in the course of the implementation of a whistleblower system, the already existing contractual obligations are extended or regulations regarding the specific reporting procedure are introduced (eg, in the form of a reporting obligation on the part of employees), the organisational behaviour would be affected and the works council must therefore be involved (section 87 (1) No. 1 BetrVG).

Furthermore, in the context of setting up an internal reporting channel, the Whistleblower Protection Act only stipulates that whistleblowers must be given the option of submitting a report to the whistleblowing system in text form or verbally. This could, of course, also be provided via digital channels - eg, via software- or web-based solutions. Should the introduction and use of such technical equipment in the relevant case allow the employer to monitor the behavior or performance of employees (eg, those who deal with the complaint), further co-determination rights of the works council according to section 87 (1) No. 6 BetrVG can be triggered.   

No, but the provisions of Law No. 93/2021 do not affect the right of employees to consult their representatives or trade unions and the protective rules associated with the exercise of this right, and the right of trade unions, employers' associations, and employers to conclude a collective bargaining agreement.

Employers must inform employees of the existence of a whistleblowing system. Potential whistleblowers must be adequately informed about the internal reporting channel and the reporting procedure. Therefore, an internal whistleblowing policy must be created that meets the legal requirements.

A whistleblowing system processes personal data. Therefore, the employees must be provided with basic information about the use of their data. The information must include details on who processes the data, to whom the data will be disclosed, what the data will be used for and how long the data will be stored.

Companies and legal entities in the public sector must ensure that protected persons have easy access to clear information on the option and procedure of whistleblowing to internal and external bodies. As external persons may also be protected, it is usually necessary to publish this information (eg, on their website).

The Whistleblower Protection Act does not oblige the company itself to publish any information regarding the internal reporting office or the internal reporting channel implemented. However, the internally implemented reporting office must have clear and easily accessible information available on the external reporting procedure and relevant reporting procedures of European Union institutions, bodies or agencies (section 13 (2) HinSchG).

The current explanatory memorandum to the Whistleblower Protection Act also contains the more detailed, but not legally binding, reference that the information can be made available via a public website, company intranet or a bulletin board that is accessible to all employees. In this context, it is recommended that the company also refers to the internally implemented reporting office or the internal reporting channel in the same way. This helps to counteract the risk that potential whistleblowers will report primarily via the external reporting channel.

Furthermore, the German Supply Chain Due Diligence Act (LkSG) also provides for the implementation of complaint mechanisms so that the regulatory requirements of companies can also be met through a uniform reporting system. Within its scope of application, the LkSG also provides for the publication of procedural rules for such a reporting system in text form as well as for annual reporting obligations on what measures the company has taken as a result of complaints.

There are no specific publicity measures for the whistleblowing procedure within companies (as long as the whistleblowing procedure rules are not considered an internal regulation of the company, as this would entail publicity).

Third parties may be entrusted with managing the internal reporting channel (section 13(4) HSchG). As a result, the rights and obligations of the channel are transferred to the third party. It is not specified who such a third party may be. According to Recital 54 of the Whistleblowing Directive, third parties may be, for example, external reporting platform providers, external consultants, auditors, trade union representatives or employee representatives. If they are located abroad, the legal system in that country must be respected. However, ultimate responsibility always remains with the company or legal entity.

In principle, the Whistleblower Protection Act intentionally does not specify which persons or organisational units are best qualified to carry out the tasks of the internal reporting office or to manage the corresponding reporting channel. However, the internal reporting office may not be subject to any conflicts of interest and it also must be independent. The EU Whistleblower-Directive mentions, for instance, the head of the compliance department or the legal or data protection officer as possible internal reporting offices.

If, in addition to the (internal) persons responsible for receiving and processing internal reports, other (external) persons have to be involved in a supporting activity, this supporting activity is legally only permissible to the extent that is necessary for the supporting activity. This applies, for example, to IT service providers that provide technical support for reporting channels.

It is also legally permissible to appoint a third party to carry out the tasks of an internal reporting office, including the reporting channel (section 14 (1) HinSchG). Third parties may include lawyers, external consultants, trade union representatives or employee representatives.

However, engaging a third party does not relieve the employer of the obligation to take appropriate action to remedy a possible violation. In particular, for follow-up actions to check the validity of a report, there must be cooperation between the commissioned third party and the employer.

The internal reporting channels may be operated internally or externally, and independency, impartiality, confidentiality, data protection, secrecy and the absence of conflicts of interest must be guaranteed.

Section 8 HSchG contains extensive specific provisions on data protection. It states that the processing of ordinary, sensitive and even criminally relevant data is permissible. Data processing must be limited to what is necessary to establish and punish an offence. The principles of purpose limitation and data minimisation apply.

Personal data not necessary for the processing of a complaint must not be collected. Data necessary for the processing of a complaint must be kept for five years.

In addition to information about the option and procedure of reporting, the information obligations under data protection law under the GDPR must also be observed. For the establishment of a whistleblower system, companies must implement technical and organisational measures under the GDPR and keep them up to date.

The internal reporting office implemented by the employer is, initially, authorised to process personal data insofar as this is necessary for the fulfilment of its task under the Whistleblower Protection Act (10 HinSchG). The wide-ranging processing authority allows the personal data contained in the reports to be both received and analysed by the reporting office. In addition, new personal data may be recorded and further processed during the implementation of the follow-up measures.

The employer's obligation to protect the data collected in the course of the whistleblowing procedure is then directly based on the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. This means, for instance, that data processing has to be limited to the extent necessary to fulfil the tasks of the internal and external reporting channel – data minimisation principle, (article 5 (1) lit. c) GDPR).

Finally, the processing of personal data is complemented by the confidentiality requirements of internal (and external) offices, (section 8 HinSchG).

Any processing of personal data shall be carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, the Law No. 58/2019, which ensures the implementation, in the national legal order, of Regulation (EU) 2016/679, and the Law No. 59/2019, which approves the rules on the processing of personal data for the purpose of prevention, detection, investigation or prosecution of criminal offences or the enforcement of criminal sanctions.

Additionally, personal data that is manifestly not relevant to the processing of the report, shall not be retained and must be deleted immediately.

Nevertheless, there is a duty of preservation regarding complaints presented orally by recording the communication in a durable and retrievable form.

The HSchG provides only very general guidelines. For example, internal reporting channels are required to maintain the confidential identity of the whistleblower and third parties and to act impartially and objectively. The employer must provide for this. Every report must be investigated, and any obviously false reports must be dismissed.

Companies must follow these guidelines but are free to implement their own personnel structure, specific design and the nature of the internal reporting channel.

The reporting channels must be designed in such a way that only the persons responsible for receiving and processing the reports as well as the persons assisting them in fulfilling these tasks have access to the incoming reports. It must, therefore, be ensured that no unauthorised persons have access to the identity of the person making the report or to the report itself. This has implications for the technical design of the internal reporting channel.

Also, the persons entrusted with running the internal reporting office must indeed be independent in the exercise of their activities and the company must ensure that such persons have the necessary expertise. Therefore, smaller or medium-sized companies should especially assess whether it will be more efficient to assign an experienced external ombudsperson to receive and initially process incoming reports. However, the ombudsperson who takes the call in this case is a witness bound to tell the truth, even if this is, for example, a company lawyer.

According to the German Whistleblower Protection Act, the internal whistleblowing reporting office is not obliged by law to accept or process anonymous reports; however, they “shall” be processed.  Companies should therefore assess carefully whether they provide systems that enable anonymous reports, as this may increase the number of abusive reports and make enquiries impossible. On the other hand, some ISO standards require the receipt of anonymous reports. Therefore, should a company seek certification according to these ISO standards, the whistleblower procedure to be set up must allow for the processing of anonymous reports.

The completeness, integrity and preservation of the complaint, the confidentiality or anonymity of the complainants and the confidentiality of any third parties mentioned in the complaint must be guaranteed. Unauthorised access must also be prevented.

The Whistleblowing Directive only applies to the reporting of violations of law in those areas that are mentioned in the Whistleblowing Directive itself or fall within the scope of the EU legislation listed in the Annex to the Whistleblowing Directive. However, the Austrian legislature has extended the application of the HSchG so that the areas mentioned in sections 3(3) to (5) HSchG have been named and no reference to the Whistleblowing Directive has been included in the relevant provisions.

The legal areas covered include the prevention of money laundering and terrorist financing, environmental protection, public health, consumer protection, privacy and personal data protection, and the security of networks and information systems.

Violations in other areas of law do not fall within the scope of the HSchG. As a result, whistleblowers who report violations that are not explicitly mentioned are not protected by the corresponding protection provisions. However, companies and legal entities are free to open their internal reporting channels for disclosures that do not fall within the scope of the law.

The Whistleblower Protection Act´s  material scope of application goes beyond European legal requirements. It extends the material scope of application to all violations that are subject to punishment (section 2 (1) No. 1 HinSchG). Additionally, violations subject to fines are included insofar as the violated regulation serves to protect life, body, health or the rights of employees or their representative bodies (section 2 (1) No. 2 HinSchG). The last alternative covers not only regulations that directly serve occupational health and safety or health protection, but also related notification and documentation requirements, for example under the Minimum Wage Act. Thus, as a result, section 2 (2) No. 2 HinSchG covers the majority of administrative offences in the context of employment.

Finally, the Whistleblower Protection Act also provides for a list of infringements that predominantly correspond to the relevant areas of law according to the recitals of the EU Whistleblower Directive.

For this law, the following shall be considered an infringement:

• anything contrary to the rules contained in the Acts of the European Union referred to in the Annex to Directive (EU) 2019/1937 of the European Parliament and the Council, or any national rules implementing, transposing or complying with such acts or to any other rules contained in legislative instruments implementing or transposing them, including those providing for criminal offences or administrative offences, concerning the fields of:
  • public procurement;
  • financial services, products and markets and the prevention of money laundering and financing of terrorism;
  • product safety and compliance;
  • transport safety;
  • environmental protection;
  • radiation protection and nuclear safety;
  • food and feed safety, animal health and animal welfare;
  • animal health and welfare;
  • public health;
  • consumer protection; and

the protection of privacy and personal data and security of network and information systems;

• anything contrary to and detrimental to the financial interests of the European Union referred to in article 325 of the Treaty on the Functioning of the European Union (TFEU), as specified in the relevant Union measures;
• anything contrary to the internal market rules referred to in article 26(2) TFEU, including competition and state aid rules, as well as corporate tax rules;
• violent, especially violent and highly organised crime, as well as the crimes provided for in article 1(1) of Law No. 5/2002 of 11 January establishing measures to fight organised and financial crime; and
• anything contrary to the rules or provisions covered by paragraphs (a) to (c).

Although it is not expressly foreseen in EU and domestic legislation, it is debatable whether breaches or violations of employment law rules are subject to whistleblowing.

Internal reporting units are nothing new, especially in financial services. However, there are also special provisions in the HSchG for the financial sector. For example, the threshold of 50 employees does not apply to companies that are subject to certain European legislation (eg, MiFID 2 or PSD2), which means that the provisions of the Austrian Whistleblower Act would apply (unless the relevant law already contains binding provisions or national regulations on whistleblower protection.)

The Whistleblower Protection Act itself does not distinguish between different sectors regarding the internal reporting process. However, it contains an enumerative list of regulations from other statutes that take precedence over the Whistleblower Protection Act for the reporting of information on violations; these regulations are therefore lex specialis compared to the Whistleblower Protection Act (section 4 (1) HinSchG). Priority special provisions are, among others, regulated by the Money Laundering Act, the Banking Act, the Insurance Supervision Act and the Stock Exchange Act.    

According to article 116-AA of the Legal Framework of Credit Institutions and Financial Companies, credit institutions must implement specific, independent and autonomous means for receiving, processing and filing reports of serious irregularities related to their administration, accounting organisation and internal supervision, and any serious signs of breaches of the duties provided for in the Legal Framework or Regulation (EU) No. 575/2013 of the European Parliament and the Council. Parliament and the Council.

A Whistleblower is a person who has received information about violations or infringements of the relevant statutory provisions due to current or former professional connections (section 2(1) HSchG).

A whistleblower is a natural person who, in the context of his or her professional activity or in the preliminary stages of professional activity, has obtained information about violations and reports or discloses it to the – internal or external – reporting offices provided for under the Whistleblower Protection Act (section 1 (1) HinSchG).

The Whistleblower Protection Act also applies to the protection of persons who are subject to a report or disclosure, as well as other persons who are affected by a report or disclosure, (section 1 (2) HinSchG).

According to Law No. 93/2021, a whistleblower is a natural person who reports or publicly discloses an infringement based on information obtained in the course of a professional activity, regardless of the nature of this activity and the sector in which it is carried out.

A whistleblower is anyone who learns of a violation of the law in the course of his or her work and reports it. In addition to employees, this includes applicants, trainees, volunteers, board members, employees of contractors, consultants and (sub)suppliers. An ongoing contractual relationship is not required. Furthermore, people who are close to the whistleblower or who support him or her (eg, colleagues and relatives) are also included.

Whistleblowers may be employees, but also, for instance, self-employed persons, volunteers, members of corporate bodies or employees of suppliers. In addition to persons who obtain knowledge in advance, such as in a job interview or during pre-contractual negotiations, the scope of protection also includes those for whom the employment or service relationship has been terminated. As a result, the status of a whistleblower is not dependent on formal criteria such as type of employment.

The following may be considered whistleblowers: employees in the private, social or public sector; service providers, contractors, subcontractors and suppliers, as well as any persons acting under their supervision and direction; and shareholders and persons belonging to administrative or management bodies, or supervisory or controlling bodies of legal persons, including non-executive members and volunteers and interns, remunerated or unremunerated.

The person must have learned of the violations through a current or former professional relationship. External persons such as customers, suppliers, business partners or other third parties who know relevant information can also act as whistleblowers and make reports. The scope of protection is very broad.

To be qualified as a whistleblower, the person providing the information must have obtained the information in the context of his or her professional activity or in the preliminary stages of professional activity. Information about violations falls within the substantive scope of the Act only if it relates to the employing entity or another entity with which the whistleblower is or has been in professional contact.

Only persons who report or divulge infringements based on information obtained in the course of their professional activity will be protected as whistleblowers. However, the fact that the complaint or public disclosure of an infringement is based on information obtained in the course of a professional relationship that has ended, or during the recruitment process or other pre-contractual negotiation stage of an existing or unincorporated professional relationship, does not preclude the person from being regarded as a whistleblower.

Whistleblowers are also protected by the law if they report anonymously or want to remain anonymous. The HSchG does not specify whether companies or legal entities must investigate anonymous reports. However, in practice some companies that have already implemented a whistleblowing system accept and investigate anonymous reports. Anonymous reporting can pose certain challenges; if the whistleblower remains anonymous, it may be more difficult to ask follow-up questions or request additional information to verify the report.

The Whistleblower Protection Act does not state that the employer must set up reporting channels in such a way that anonymous reports are admissible (section 16 (1) HinSchG). Also, external reporting offices do not have to process anonymous reports (section 27 (1) HinSchG). According to the Whistleblower Protection Act, however, anonymous reports “shall” be processed by the internal and external reporting offices. Against this background, employers are entirely free to choose whether to provide systems that allow for the submission and processing of anonymous reports or not.

Not only are they admissible, but internal reporting channels must guarantee the anonymity of whistleblowers or else they will face severe penalties.

No, the whistleblower does not need to be a direct witness to the violation they are reporting. Whistleblowing can be based on information or circumstances known to the whistleblower, even if he or she is not a direct witness to the violation.

In principle, the whistleblowers do not have to be direct witnesses to a violation. However, they must have obtained information about violations in connection with or before their professional activities. Violation information is defined as a reasonable suspicion or knowledge of actual or potential breaches and attempts to conceal such breaches that have occurred or are very likely to occur (section 3 (3) HinSchG). However, only whistleblowers acting in good faith are protected from any discriminatory measures as a result of their report.

The whistleblower should have an opportunity to provide all the necessary information regarding the complaint he or she wishes to report, as well as the date and place where the facts have occurred or are continuing to occur and should have an opportunity to attach documents or audio and video files that may serve as a basis for the complaint. The information provided by the whistleblower should be as detailed as possible, bearing in mind that the complaint creates suspicion towards a subject or a situation.

Please refer, also, to question 23.

Whistleblowing information must be provided in writing or verbally to the internal reporting channel. If the whistleblower requests a meeting, it must be held within 14 days. Once information is received, the allegations must be investigated promptly and thoroughly. This may include gathering additional evidence, conducting interviews and taking appropriate action to remedy any violations identified. Whistleblowers also have the right to add to or correct any information provided. Feedback must be provided to the whistleblower no later than three months after receipt of the information. This includes information on follow-up action or the reasons why the information was not followed up.

The whistleblower procedure requires – in its broad outlines – that the personal and material scope of the Whistleblower Protection Act is applicable. Assuming this, the whistleblower must have obtained information about violations in connection with his or her professional activities or in advance of professional activities. In a further step, the whistleblower must report or disclose these violations to the internal and external reporting bodies responsible. The Reporting Office will issue an acknowledgement of receipt to the person making the report within seven days. Within three months of the acknowledgement of receipt, feedback will be provided to the whistleblower on planned and already taken follow-up measures and their reasoning. This information will be documented in compliance with the principle of confidentiality. This documentation will be deleted two years after the conclusion of the proceedings.

The identity of the whistleblower, as well as any information that directly or indirectly allows the identity of the whistleblower to be revealed, is confidential and access is restricted to persons responsible for receiving or following up complaints. Additionally, entities and competent authorities responsible for receiving and handling complaints must keep a record of the complaints received and retain it for at least five years or, regardless of this limit, while judicial or administrative proceedings relating to the complaint are pending. Complaints made verbally, by recorded telephone call or other recorded voice message systems, may be recorded, with the consent of the complainant, by recording the disclosure on a durable and retrievable storage medium or transcribing the communication fully and accurately.

The whistleblowing system must be designed so that the whistleblower is encouraged to use the internal reporting channel before using the external reporting channel. This is not a mandatory requirement for the whistleblower, it just means that a whistleblower should use external channels only after he or she has made an internal report. In particular, the external reporting system should be used when dealing with the information under the internal whistleblowing system is not possible, inappropriate or has proved unsuccessful or futile. Whistleblowers are also protected when reporting directly through external channels.

There is no legally binding hierarchy between internal and external reporting channels. Therefore, the whistleblower has, in principle, the right to choose whether to report the violations externally or internally. However, in cases where effective internal action can be taken against violations, whistleblowers are to give preference to reporting to an internal reporting office. If an internally reported violation is not remedied, the whistleblower making the report is free to contact an external reporting office (section 7 (1) HinSchG).

Reports of infringements are submitted by the whistleblower through internal or external reporting channels or are publicly disclosed. The whistleblower may only use external reporting channels when:

• there is no internal whistleblowing channel;
• the internal whistleblowing channel only allows the submission of complaints by employees, and the whistleblower is not an employee;
• it has reasonable grounds to believe that the infringement cannot be effectively disclosed or resolved internally or that there is a risk of retaliation;
• an internal complaint was initially lodged but no communication regarding the measures expected or to be taken following the complaint within the time limits laid down in article 11 of  Law No. 93/2021; and
• the breach is a criminal offence or an infraction punishable with a penalty of more than 50,000 EUR.

The whistleblower can only publicly disclose an infringement if:

• they have reasonable grounds to believe that the breach may constitute an imminent danger to the public interest, that the breach cannot be effectively disclosed to or dealt with by the competent authorities in the specific circumstances of the case or that there is a risk of retaliation, including in the case of an external complaint; or
• they have filed an internal complaint and an external complaint, or an external complaint under the terms of Law No. 93/2021 without appropriate measures being taken within the time limits provided for in articles 11 and 15 of the referred law.

HSchG does not impose such an obligation. However, reporting may be required based on other regulations, for example, in cases of suspected money laundering or terrorist financing.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

External complaints will be submitted to those authorities that, under their duties and powers, should know the matter covered by the complaint, including:

• the Public Prosecutor’s office (Ministério Público);
• the criminal police bodies;
• the Bank of Portugal;
• independent administrative authorities;
• public institutes;
• the Inspectorates-General, similar entities and other central services of the direct administration of the state with administrative autonomy;
• local authorities; and
• public associations.

The whistleblower is protected if the information is subsequently found to be false, but there were reasonable grounds for believing that the information was true, or if, under the given circumstances and with the available means of verification, the information could be reasonably assumed to be true.

There is no protection if false information is disseminated intentionally or through gross negligence. Unfortunately, there is no regulation regarding the possible duty of the whistleblower to verify his or her information or suspicions.

As a principle, the disclosure of inaccurate information about violations is prohibited under the Whistleblower Protection Act (section 32 (2) HinSchG). A whistleblower may, however, not be sanctioned if the facts, after being verified, are merely not confirmed or do not constitute a violation in the final analysis. If the information disclosed was incorrect, the following legal consequences will apply:

On the one hand, the whistleblower must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). The whistleblower's liability for damages is based on the fact that a false report or disclosure has far-reaching consequences for the person affected or accused. The effects may no longer be completely reversible. According to the Whistleblower Protection Act, claims for damages resulting from merely negligent incorrect reporting should not arise. Besides, only whistleblowers acting in good faith are protected from further repercussions.

On the other hand, the whistleblower acts improperly if he intentionally discloses incorrect information in violation of section 32 (2) of the Whistleblower Protection Act (section 40 (1) HinSchG). This administrative offence may be punished with a fine of up to 20,000 EUR (section 40 (5) HinSchG).

The whistleblowing or public disclosure of an infringement, carried out under the requirements imposed by Law No. 93/2021 of 20 December, shall not in itself constitute grounds for disciplinary, civil or criminal liability for the whistleblower.

Nevertheless, if the whistleblower knew, or should reasonably have known, their complaint was false, he or she may be subject to disciplinary proceedings.

A fine of up to 20,000 euro may be imposed on anyone who obstructs or attempts to obstruct a whistleblower, or who exerts pressure on such a person through vexatious judicial or administrative proceedings. A fine of up to 40,000 euro may be imposed for repeat offences (section 24 No. 1 HSchG).

Retaliation against the whistleblower is prohibited under the Whistleblower Protection Act. This also applies to threats and attempts at retaliation (section 36 (1) HinSchG). In addition, it is prohibited to interfere or attempt to interfere with reports or communications between a whistleblower and the reporting office (section 7 (2) HinSchG).

If the whistleblower was nevertheless obstructed, the following legal consequences will apply: if a retaliation occurs, the person causing the violation must compensate the whistleblower for the resulting damage. However, this does not entitle the whistleblower to an employment relationship, a vocational training relationship, any other contractual relationship, or career advancement.

In addition, taking an illegal reprisal or interfering with the communications between the whistleblower and the reporting office constitutes an administrative offence, which can be punished with a fine of up to 50,000 EUR (section 40 (2) No. 3, (5) HinSchG).

It is a very serious infraction to carry out retaliation against the whistleblower. Acts or omissions are considered to be acts of retaliation if, directly or indirectly, they occur in a professional context and are motivated by an internal or external complaint or public disclosure, or they cause the whistleblower to suffer pecuniary or non-pecuniary damage unnecessarily.

The whistleblower is protected only when reporting to internal and external reporting channels. The protection applies if there are objectively sufficient signs of the existence of a violation. General experience and average general knowledge are sufficient. Legal expertise is not required.

Finally, the law provides for the publication of violations (eg, on social media) as a last resort. Except for material violations, such as endangering the public or other emergencies, this is only possible if internal or external reporting channels have been used and no appropriate action has been taken. Whistleblowers will only be protected if these conditions are met.

To obtain protection, the whistleblower generally has to contact the responsible internal or external reporting offices. Disclosure of information about violations directly to the public is subject to strict conditions. This is only permissible, for example, if there is a risk of irreversible damage or in cases where the external reporting agency has not taken the required measures (section 32 (1) HinSchG).

The whistleblower providing the information must further act in good faith (ie, must have reasonable cause to believe, at the time of the report or disclosure that the information disclosed is true, and the information relates to violations that fall within the material scope of the Whistleblower Protection Act (section 33 (1) No. 2 and 3 HinSchG).

A whistleblower who, in good faith and with a serious reason to believe that the information is true at the time of the report or public disclosure, reports or publicly discloses an infringement in the terms established in Chapter II of Law No. 93/2021 – on the means of reporting and public disclosure – will benefit from the protection granted by the referred law.

An anonymous whistleblower who is subsequently identified will benefit from the protection granted by the above-mentioned law, provided that he or she meets the conditions set out for an identifiable whistleblower

Whistleblowers enjoy the protection of confidentiality and from retaliation, immunity from liability and relief from the burden of proof. Any retaliatory measures such as termination, dismissal, suspension or transfer are therefore invalid. Whistleblowers also benefit from easier access to evidence in legal proceedings and exemptions from liability and confidentiality obligations. This means he or she is not liable for the actual or legal consequences of justified whistleblowing.

The most fundamental part of the protection is the prohibition of retaliation against the whistleblower. Therefore, the reporting or disclosing of information may not result in unjustified disadvantages such as disciplinary measures, dismissal or other discrimination against the person providing the information. In Addition, the Whistleblower Protection Act still contains a reversal of the burden of proof if the whistleblower suffers a disadvantage in connection with their professional activities. However, it is presumed that the disadvantage is a reprisal for the tip-off only if the whistleblower also asserts this themself. It should be noted, however, that the reversal of the burden of proof in favour of the whistleblower will only apply in labour court disputes and not in fining proceedings.

Furthermore, the Whistleblower Protection Act contains an exclusion of responsibility. Thus, a whistleblower cannot be made legally responsible for obtaining or accessing information that he or she has reported or disclosed, unless the obtaining or accessing of the information and the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG). In addition, a whistleblower does not violate any disclosure restrictions and may not be held legally responsible for the disclosure of information made in a report or disclosure if he or she had reasonable cause to believe that the disclosure of the information was necessary to detect a violation.

The protection provided by Law No. 93/2021 extends, in addition to the cases mentioned above, with the necessary adaptations, to:

• natural persons who assist the whistleblower in the whistleblowing procedure and whose assistance must be confidential, including trade union or employee representatives;
• third parties connected to the whistleblower, such as work colleagues or family members, who may be the target of retaliation in a professional context; and
• legal persons or similar entities owned or controlled by the whistleblower, which employ the whistleblower or are otherwise connected to the whistleblower in a professional context.

The identity of whistleblowers must be protected through internal and external reporting channels (section 8(1) HSchG). This also applies to any other information from which his or her identity could be directly or indirectly deduced.

Arguably the most significant protection is from labour law consequences or other retaliatory measures. Actions taken in retaliation against a legitimate whistleblower are legally invalid.

Furthermore, whistleblowers and those close to them are not liable for the actual or legal consequences of a justified whistleblowing report (section 22 (1) HSchG). Damages cannot be claimed against a whistleblower.

At first, the person providing the information may not be subject to legal liability for obtaining or accessing information that he or she has reported or disclosed. This does not apply if the procurement or access as such constitutes an independent criminal offence (section 35 (1) HinSchG).

In addition, whistleblowers are protected by a comprehensive prohibition of retaliation. Therefore, any adverse consequences caused by disclosure are prohibited. These include, for example, dismissal, disciplinary measures or salary reductions (section 36 (1) HinSchG). Measures that violate the prohibition are void under section 134 of the Civil Code. The prohibition of retaliation is rounded off by a reversal of the burden of proof. According to this, it is presumed that a disadvantage that occurs after a disclosure is retaliation. As a consequence, the person who has disadvantaged the whistleblower has to prove that it is factually justified and was not based on the report or the disclosure if the whistleblower also asserts the disadvantage himself (section 36 (2) HinSchG).

In addition, the whistleblower is entitled to damages in the event of a violation (section 37(1) HinSchG).

Acts of retaliation against whistleblowers are prohibited; they are entitled to legal protection and can benefit from witness protection measures in criminal proceedings.

Even though a bona fide whistleblower is protected from retaliation, he or she may be affected temporarily until those measures have been reversed.

Due to the retaliatory measures, the identity of the whistleblower could also become known within the workforce, which could lead to additional internal conflicts.

Anyone who knowingly makes a false report can be fined up to 20,000 euro, or up to 40,000 euro in repeated cases. The offence requires knowledge, which is only present in the case of intentional or conditionally intentional conduct.

If a whistleblower abusively reports a violation, this may initially give rise to criminal liability. Possible criminal offences are pretending to have committed a criminal offence (section 145d of the Criminal Code), false suspicion (section 164 of the Criminal Code) or offences of honour (section 185 et seq of the Criminal Code).

The whistleblower providing the abusive information also must compensate for any damage resulting from intentional or grossly negligent reporting or disclosure of incorrect information (section 38 HinSchG). Furthermore, there may be competing claims for damages, for example under section 823 (2) of the Civil Code in conjunction with a protective law.

Moreover, the whistleblower commits an administrative offence if he or she intentionally discloses inaccurate information. This may be punished with a fine of up to 20,000 EUR (section 40 (1), (6) HinSchG).

In principle, the whistleblower is free to decide whether he or she reports a violation through the internal or the external reporting channel (section 7 (1) HinSchG). However, if a violation is disclosed to the public directly (ie, without first using internal or external reporting channels and without there being an exceptional circumstance for this), the whistleblower is generally not subject to the protection of sections 35 to 37 of the Whistleblower Protection Act. Only in narrow exceptions is the whistleblower still protected, for example, if there is a danger of irreversible damage or comparable circumstances may represent an immediate or obvious threat to the public interest.

There may be a risk of retaliation – the following acts are presumed to be motivated by internal or external whistleblowing or public disclosure until proven otherwise, when carried out up to two years after the complaint or public disclosure:

• changes in working conditions, such as roles, hours, workplace or salary, non-promotion of the employee or breach of work duties;
• suspension of employment contract;
• negative performance review or a negative reference for employment purposes;
• failure to convert a fixed-term employment contract into a permanent employment contract, whenever the employee had legitimate expectations of such a conversion;
• non-renewal of a fixed-term employment contract;
• dismissal;
• industry blacklisting;
• termination of a supply or service contract; and
• revocation or termination of an administrative contract, as defined under the Administrative Procedure Code.