Confidentiality (HinSchG)

§ 8 HinSchG — protection of the whistleblower's identity

What is confidentiality (HinSchG)?

Protective measures:

• Encrypted intake software
• Access restriction (RBAC)
• Audit trail for every action
• Separation of HR and the reporting office
• Confidentiality undertakings

Practical example

The head of HR asks the reporting office officer 'so who filed the report?'. She must remain silent — including towards the managing director.

Legal position: Germany and Austria

Protection of the whistleblower's identity is mandatory in both countries, but rests on different national statutes, each with its own provisions, fine ranges and competent authorities.

Germany

• Confidentiality requirement — § 8(1) HinSchG: The reporting offices preserve the confidentiality of the identity of the reporting person, of the persons affected by a report and of the other persons named in the report. The identity may become known only to the persons responsible for receiving reports and taking follow-up measures and to those supporting them.
• Exceptions — § 9 HinSchG: only in narrow cases (including criminal prosecution and averting danger).
• Fine — § 40 HinSchG: breach of confidentiality up to EUR 50,000; the competent body is the fines authority (Federal Office of Justice (BfJ)).

Austria

• Confidentiality requirement — § 7(1) and (2) of the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG): The identity of whistleblowers must be protected by the internal, external and commissioned bodies; this also applies to all information from which the identity can be derived directly or indirectly. Where the content of a report becomes known to persons other than the responsible staff, those persons are prohibited from disclosing the content or the identity. This is a self-standing HSchG provision and must not be confused with data protection law.
• Administrative penalty — § 24 HSchG: A breach of confidentiality (under §§ 7 or 17(1) HSchG) is penalised by the district administrative authority (Bezirksverwaltungsbehörde) with a fine of up to EUR 20,000, and of up to EUR 40,000 in the event of a repeat offence.

See also

• Internal reporting office
• Prohibition of reprisals