Whistleblowing hotlines in Austria

Abstract

The Sarbanes-Oxley Act requires publicly-held US companies and their EU-based affiliates, as well as non-US companies listed on a US stock exchange, to establish a procedure for the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, and similar matters (so-called 'whistleblowing systems'). The Austrian data protection authority has already issued four decisions on the compatibility of such whistleblowing systems with data protection law, which impose a number of detailed requirements that go beyond those contained in the Article 29 Working Party opinion. Besides data protection issues, the implementation of whistleblowing systems also has important implications under Austrian labour and employment law.