Austria

General context and principles

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects as it relates to your country.

In May 2017, media reports revealed investigations into suspected price fixing in the construction sector between 2008 and 2014 relating to more than 20 road-building projects. Pursuant to a search warrant cited in newspaper reports, contracting parties could have suffered damages of more than €100 million. The Central Public Prosecutor’s Office for Economic Crimes and Corruption (WKStA) – in co-operation with the Austrian Competition Authority – carried out raids at several offices, including those of STRABAG and PORR at different locations. Both companies announced that they would conduct internal investigations to review the allegations and co-operate with the authorities.

2 Outline the legal framework for corporate liability in your country.

The Austrian legal system distinguishes between civil liability (for breaches of private law), criminal liability (for offences against criminal law) and liability under administrative penal law (for regulatory offences). The main focus of this chapter is on criminal liability of corporations.

Pursuant to the Law on Corporate Liability (VbVG), corporations are liable for the unlawful and culpable actions of their decision makers and, under more restrictive conditions, for the actions of their employees, provided that the offence was either committed for the benefit of the corporation or the offence violated duties incumbent on the corporation. Moreover, an offence committed by an employee must have been either rendered possible or facilitated by the decision makers’ failure to take essential precautionary measures, in particular of a technical, organisational or personal character.

By contrast to the liability for criminal offences, corporations are only directly liable for regulatory (administrative law) offences against tax law (section 28a, Penal Tax Code). In other areas of administrative penal law, there is only an indirect joint liability of the corporation for fines imposed for offences committed by the managing director or other ‘persons in charge’ (section 9, Administrative Penal Code). However, these offences are considered offences by the natural person, not the corporation.

3 In your country, what law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies relating to the prosecution of corporations?

Criminal offences are investigated by public prosecutors with the assistance of the criminal investigation department of the police. Pursuant to section 20a of the Code of Criminal Procedure (StPO), the WKStA is in charge of prosecuting economic crimes and corruption. The Federal Bureau of Anti-Corruption assists the WKStA in matters related to corruption.

Administrative law is enforced by various administrative authorities, often with sector-specific competences. The most notable examples are the Financial Market Authority, which oversees, inter alia, banks, insurance companies and companies listed at the Vienna Stock Exchange, and the Competition Authority, which conducts investigations into possible violations of national and European competition law.

Although competences between criminal and administrative authorities are distinguished ratione materiae, situations can arise in which different authorities have parallel competence over the same facts. Pursuant to section 15 of the StPO, criminal courts must autonomously decide preliminary questions pertaining to other areas of law. They may, however, await the decision of a competent court or administrative authority on such preliminary questions if the decision is to be expected in the foreseeable future. Administrative authorities, in turn, may suspend their investigations if a preliminary question forms the object of another proceeding.

4 What grounds must the authorities in your country have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

Yes, for the opening of a criminal investigation, an ‘initial suspicion’ is required. Pursuant to section 1, paragraph 3 of the StPO, this is the case whenever specific indications give reason to suspect that a criminal offence has been committed.

5 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another country?

The transnational effect of the ne bis in idem principle (which is established in section 17, paragraph 1, StPO) is based on international agreements to which Austria is a party (see Birklbauer in Fuchs and Ratz, Wiener Kommentar zur StPO, section 17). Of particular importance for the transnational effect of the principle is article 54 of the Convention implementing the Schengen Agreement (the implementing Convention), which prohibits prosecution for ‘the same offence’, if a person has been ‘finally judged’ and has already served or is serving a sentence in another contracting state (note that Austria has made declarations relating to all exceptions enumerated in article 55 of the implementing Convention).

In the context of article 54 of the implementing Convention, Austrian authorities apply different concepts of ‘same offence’ to different situations. For a criminal court, confronted with a previous sentence of another criminal court, the previous sentence deploys a blocking effect in relation to the same factual matrix. This concept is favourable for the accused. By contrast, a criminal court can convict an accused on the same facts if the accused was previously sanctioned by an administrative authority (rather than a criminal court) and the sanction did not fully correct the injustice done.

Article 54 of the implementing Convention speaks of a person who has been ‘finally judged’. According to both case law and legal scholarship, the concept of final judgment encompasses all judgments that conclude a main trial, namely both convictions and acquittals. No differentiation is made by the Court of Justice of the European Union (CJEU) between an acquittal based on a judgment on the merits or a procedural judgment. Moreover, the closure of proceedings by the prosecution authority without the involvement of a court has a blocking effect for the purpose of article 54 of the implementing Convention if it is the result of an action for compensation (in Austria, this is called Diversion – see question 41) brought by the person under investigation and the closure is final (Gözütok/Brügge, CJEU judgment of 11 February 2003, C-187/01, C-385/01). Other provisions dealing with previous convictions abroad are section 192 of the StPO and section 66 of the Austrian Penal Code (StGB).

A further provision entitling criminal prosecutors to refrain from prosecution is contained in section 192, paragraph 1 of the StPO (which applies in cases falling outside the scope of the implementing Convention or other international agreements) provided that the suspected person is charged with several offences, the person has already been convicted by a foreign court for the offence or the person has made compensation abroad and as a result has been exempted from further prosecution (Diversion), and no more severe penalty is to be expected in Austria. Finally, pursuant to section 66 of the StGB, Austrian courts must take into account a punishment for the same crime imposed and served abroad.

6 Does criminal law have general extraterritorial effect in your country? To the extent that extraterritorial effect is limited to specific offences, describe those which have extraterritorial effect, the statutory basis and any conditions that must be met for extraterritoriality to apply.

Austrian criminal law has no general extraterritorial effect (section 62, StGB). Criminal offences committed on an Austrian ship or aeroplane are subject to the StGB, as are certain offences regardless of the criminal law of the location of the offence, including economic espionage, criminal offences against an Austrian official, human trafficking, terrorism, corruption and several other types of major crimes (section 64, StGB).

Other offences committed abroad are only subject to Austrian criminal law (1) if the offence is also punishable under the laws of the place where the offence is committed, (2) if the offender is Austrian or is arrested in Austria and cannot be extradited, and (3) none of the exceptions set out in section 65, paragraph 2, no. 4 of the StGB applies.

7 Describe the principal challenges in your country that arise in cross-border investigations, and explain whether and how such challenges are dependent on other countries involved.

The co-operation between Austrian prosecutors and their counterparts in other EU Member States is greatly facilitated by three instruments: the European evidence warrant, the European Investigation Order (EIO) and joint investigation teams (JITs). Hereafter, the focus of our discussion is on the latter two. Also of relevance is the Law on Judicial Cooperation in Criminal Matters.

The EIO replaces the classic system of judicial assistance, as it allows the competent authority of one EU Member State (the Issuing State) to order, after validation by a court or public prosecutor of the Issuing State, the execution of most acts of investigation, including coercive measures, in another EU Member State (the Executing State) (article 2, Directive 2014/41/EU of 3 April 2014). Subject to certain grounds for non-recognition or non-execution or postponement, the Executing State must ensure the execution of the order as if the investigative measure concerned had been ordered by a domestic authority (article 9, Directive 2014/41/EU). The national law of the Executing State may provide that authorisation by a domestic court is required (article 2(d), Directive 2014/41/EU). When this is not the case, the EIO may be directly executed by the executing authority.

JITs are multinational investigation teams based on an agreement between two or more law enforcement authorities in EU Member States and are set up to investigate a specific purpose for a fixed period. The co-operation can be extended to non-EU Member States if all other participating parties agree.

By contrast, the co-operation between Austrian prosecution authorities and non-EU Member States (and Denmark) still follows traditional judicial assistance practice based on the principle of reciprocity and governed by international agreements and, when these do not contain a governing rule, the Extradition and Judicial Assistance Law, which only applies in ongoing criminal proceedings in Austria; it does not apply to administrative proceedings. Unless an international agreement provides for direct judicial assistance, the Austrian authorities must request judicial assistance through the Federal Ministry of Justice. Moreover, unlike in an EIO, the public prosecutors must request and obtain court authorisation from the domestic court for co­ercive investigation measures.

Finally, special challenges arise when investigations relate to countries with strong secrecy rules, for example Switzerland and Swiss banking secrecy.

8 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

See question 5, and paragraph 17 of the preamble to Directive 2014/41/EU regarding the European investigation order in criminal matters, which allows an EIO aiming ‘to establish whether a possible conflict with the ne bis in idem principle exists’.

9 Do your country’s law enforcement authorities have regard to corporate culture in assessing a company’s liability for misconduct?

Austrian enforcement authorities must take the corporate culture into account when assessing whether the management adopted the necessary precautionary measures to prevent criminal offences (see question 2). The types of measures required depends on the type, size and sector of the corporation, the dangers involved, and the education and reliability of employees (see Hilf and Zeder in Höpfel and Ratz, Wiener Kommentar zum StGB, 2nd edition, VbVG, section 3, no. 42 with reference to the legislative materials).

Further, a robust corporate culture may form the basis for the authority to exercise its discretion to refrain from prosecuting an offence. The public prosecutor must consider the conduct of the corporation before and after the alleged offence (section 18, VbVG – see question 41).

In addition, an employer’s directives requiring employees to adhere to the law are recognised as a mitigating factor for sentencing purposes (see question 54).

10 What are the top priorities for your country’s law enforcement authorities?

Fighting corruption is an express priority of the current government, more specifically the Austrian Ministry of Justice. Since Austria’s ratification of the UN Convention against Corruption in January 2006, a – more or less – constant improvement of the anti-corruption laws could be observed. A number of legislative improvements have been implemented to fight corruption, including the creation of the Federal Bureau of Anti-Corruption in 2010 and the WKStA in 2011 (see question 3).

11 How are internal investigations viewed by local enforcement bodies in your country?

The views of local enforcers can vary. Internal investigations may be regarded as helpful, especially if the results are shared with the prosecution, or as a fig leaf, that obfuscates rather than assists the criminal investigation. The sharing of the results of an internal investigation may be taken into account as a factor leading criminal prosecutors to refrain from prosecution (section 18, VbVG – see question 41).

Before an internal investigation

12 How do allegations of misconduct most often come to light in companies in your country?

Occasionally, allegations of misconduct arise out of tax audits. It is also not infrequent that competitors and victims of misconduct bring unlawful conduct to the attention of the authorities. Other common ways are chance discoveries of an offence, whistleblowers, standard screening processes, suspicious activity reports, internal audits, tax reporting, compliance and media reports.

13 Does your country have a data protection regime?

EU regulations on data protection – with their usual high standards – are applicable in Austria. The General Data Protection Regulation (GDPR), which is directly applicable in all EU Member States, became effective on 25 May 2018. In addition to the GDPR regime, the Austrian Law on Data Protection (DSG) has additional provisions on data protection, as well as institutional and procedural aspects.

Personal data is defined as any information relating to an identified or identifiable natural person (see article 4, GDPR). When it comes to the processing of personal data during an internal investigation, companies must comply with GDPR stipulations. According to article 5 of the GDPR, personal data shall be collected only for specific, explicit and legitimate purposes and, inter alia, be processed lawfully, fairly and transparently. In that regard, the processing of personal data is lawful only if, inter alia:

• the data subject has given consent;
• it is necessary for the performance of a contract or responds to the data subject’s request prior to entering a contract;
• it is necessary for compliance with a legal obligation to which the data’s controller is subject; or
• it is necessary for the purpose of the legitimate interests of the data’s controller (see article 6, GDPR).

Moreover, the GDPR provides for a catalogue of rights applicable to data subjects, including the right to be informed about the processing and storage of personal data, the purpose of data processing and the duration of storage. Furthermore, the GDPR provides for a data subject’s right to file a complaint with the relevant supervisory authority (see question 14) if the processing of personal data may have violated data protection rights.

14 How is the data protection regime enforced?

As is widely known, infringements of GDPR provisions are sanctioned by severe administrative fines, which can reach €20 million or 4 per cent of the corporation’s annual global turnover, whichever is higher. Implementing the GDPR provisions, Austria’s Data Protection Authority (Datenschutzbehörde (DSB)) was installed to monitor the application of the regulation. Accordingly, the DSB, as Austria’s supervisory public authority, is competent to enforce GDPR provisions.

As an exceptional measure in implementing GDPR provisions, the Austrian legislature added its own provision regarding the DSB’s use of corrective powers (see article 58, GDPR). According to section 11 of the DSG, the DSB shall make use of its corrective powers according to article 58 of the GDPR, particularly in the case of first-time infringements, primarily by issuing warnings. Since the GDPR does not entitle EU Member States to direct supervisory authorities on how to exercise their powers, this provision may violate the DSB’s independence, according to article 52 of the GDPR.

15 Are there any data protection issues that cause particular concern in internal investigations in your country?

As in all EU Member States, GDPR provisions must be considered closely when it comes to processing data. The term ‘processing’ is defined as any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organising, structuring, storage, adaptation or alteration, retrieval, consultation upon, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (see article 4, GDPR).

During an internal investigation, a considerable amount of evidence, including personal data, will be processed by collecting, storing, using, disclosing, etc. To comply with GDPR provisions, it should be well documented which data is classified as personal and which as non-personal. Furthermore, investigating companies should document in detail the purpose of processing personal data and comply with GDPR provisions regarding storage limitations, integrity and confidentiality. Besides that, companies should be especially careful when it comes to transnational data transfers, especially from or to non-EU Member States.

16 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress the company has if those limits are exceeded.

With the approval of the court, the public prosecutor may order the search of a specific location – for instance an office building – to collect, temporarily secure or seize evidence, as well as any kind of assets that may serve as evidence, not only for the subsequent phases of the proceedings but also for the sole purpose of securing civil claims of parties injured by the (alleged) criminal offence (section 119, paragraph 1, StPO). Especially in cases in which there is a risk that by waiting for a court order the evidence may become unavailable, the public prosecutor may order the search of a location before seeking court approval (section 120, StPO).

Persons in possession of documents, data carriers or assets that form the object of a request for temporary securing are under a legal duty to comply unless they are suspected of the underlying offence or discharged from testifying, or have a right to refuse to give evidence (section 111, StPO). However, the public prosecutor can obtain the evidence by coercive means, such as a house search. On the protection of privileged material, see question 17.

In addition to prior or subsequent court approval, house searches are subject to certain prerequisites. Most importantly, there must be a founded suspicion (this threshold is higher than the initial suspicion required to open investigations – see question 4) and the coercive measure needs to comply with the principle of proportionality. A temporary securing or seizure is not lawful if a less intrusive means is available (for instance by photocopying documents – see section 110, paragraph 4, StPO).

Persons against whom a search warrant was issued or whose premises were subject to a house search can file an objection with the competent public prosecutor within six weeks of the measure (section 106, StPO). The public prosecutor can either comply with the objection or, within four weeks, pass the objection to the competent criminal court.

17 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Attorney work-product and attorney–client communications are protected in several ways. Attorneys (and a small number of other professions) have a legal duty of confidentiality and a right to refuse to give evidence (section 157, StPO). The duty may not be circumvented. This prohibits the seizure of attorney documents and the information contained therein at the attorney’s premises and, since November 2016, also at the premises of clients under suspicion or accused in criminal proceedings. The attorney–client confidentiality only extends to the attorney’s work-product and attorney–client communications created for the purpose of defending the client and not to previously existing evidence.

Any person subject to or present during a measure of temporary securing may object to the temporary securing of material protected by attorney–client confidentiality (sections 106 and 115, StPO). In the case of such an objection, documents and data carriers have to be sealed and presented to a court, which must decide promptly whether the evidence is protected (section 112, StPO).

18 Are there any privileges in your country that would prevent an individual or company from providing testimony? Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow in your country from such compelled testimony?

Accused individuals or companies have a right to avoid self-incrimination. In the case of a corporation, the managers (persons in charge) as well as the employees suspected of having committed an offence are to be interrogated as accused (section 17, paragraph 1, VbVG). It is forbidden to use coercive measures (or promises or misleading statements) to induce the accused to make a statement (section 7, paragraph 2, StPO). Pursuant to section 166 of the StPO, compelled testimony is classed as prohibited evidence and is null and void.

Relatives of the accused are discharged from the duty to testify (section 156, paragraph 1, no. 1, StPO) and witnesses can refuse to testify if they would incriminate themselves or expose a relative to the risk of criminal prosecution (section 157, paragraph 1, no. 1, StPO). On attorney–client confidentiality, see questions 17 and 29.

Privileges exist for members of certain professions, such as lawyers, auditors, medical doctors, psychiatrists, mediators, priests and reporters (section 157, StPO).

19 What legal protections are in place for whistleblowers in your country?

Whistleblowers can bring alleged offences anonymously to the attention of the WKStA through a whistleblower website, for which a legal basis was created in 2015.

A whistleblower may benefit from the crown witness regulation (section 209a, StPO). This regulation concerns serious offences and is available, if the witness freely confesses his or her contribution to the offence, if the information disclosed is new and not yet part of an investigation against the witness, and if it contributes substantially to the investigation. Subject to further prerequisites (section 209a, StPO), criminal prosecutors may terminate the investigations against such a person. Similarly, section 11b of the Austrian Act on the Establishment of a Competition Law Authority also contains a crown witness regulation. Other provisions on whistleblowing are contained in section 48i of the Federal Law on the Stock Exchange (BoerseG).

20 What rights do employees possess under local employment law that determine how they are treated within a company if their conduct is within the scope of an investigation? What employment rights would attach if they are deemed to have engaged in misconduct? Does it differ for officers and directors of the company?

Employers have a duty of care towards their employees, including employees in an executive or managerial position (section 1157, paragraph 1, Austrian Civil Code; section 18, paragraph 4, Law on Employees (AngG). Pursuant to this duty, the employer must, inter alia, respect the private life of employees, protect their honour and treat them equally. This also has an effect on the conduct of internal investigations. Prior to an interview, the employer (or third party acting for the employer) should, for instance, inform employees that they may be accompanied by their own legal representative at least in situations of a (potential) conflict of interest. For protection provided by other branches of law, see question 38.

A finding of misconduct will frequently destroy the trustworthiness of the employee and justify dismissal. However, a mere suspicion of a criminal offence is insufficient. Stricter standards apply to employees in executive positions (Decision of the Austrian Supreme Court RS0029652).

21 Are there disciplinary or other steps that a company must take in your country when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation? Can an employee be dismissed for refusing to participate in an internal investigation?

Under Austrian law, an employer may only dismiss an employee without giving notice if the employer exercises this right immediately after becoming aware of the reason justifying the dismissal (Decision of the Austrian Supreme Court RS0029131). Employers forfeit this right if they fail to exercise it immediately (controversial in cases of a suspected criminal offence, see Heinz-Ofner in Reissner, AngG, 2nd edition, section 27, no. 52). If there is any doubt, the employer can suspend the employee until the investigation yields more evidence.

Employees have a duty of loyalty to their employer and a duty to inform (for the employer’s corresponding duty of care, see question 20). Whether this duty gives rise to an obligation to answer the questions of private investigators that may reveal personal misconduct is a matter of controversy in Austrian scholarship. On the one hand, it is recognised that the right against self-incrimination is only applicable as regards state authorities. On the other, it has been argued that an employee must have some right against self-incrimination, if the internal investigation forms a prelude to criminal investigation, since the employee would otherwise be effectively deprived of his or her defence rights in criminal proceedings (see, for example, Ingeborg Zerbes, Strafrechtliche Grundsatzfragen ‘interner Untersuchungen’, Jahrbuch Wirtschaftsstrafrecht und Organverantwortlichkeit 2013, 263, at pages 271 and 272). To our knowledge, the matter has not yet been decided by a court.

Commencing an internal investigation

22 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Austrian corporations follow the international practice of setting out the terms and the personal, material and temporal scope of an internal investigation in a document. The issues usually covered include:

• person acting as internal investigator;
• definition of types of documents and electronic data (correspondence, documents) and method of screening;
• internal or external interviewers;
• persons to be interviewed;
• definition of documents or (provisional) outcomes of the internal investigation with which the interviewees will be confronted;
• channels of communication;
• involvement of accounting department;
• definition of spheres of confidentiality;
• phases of the internal investigation;
• point in time of informing persons whose data is used; and
• treatment of data during and after completion of the investigation.

23 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

In principle, companies are under no legal duty to bring misconduct to the attention of enforcement authorities. Doing so can allow a company to benefit from the crown witness regulation (see question 19) or from gaining ‘victim status’ (as an injured party) rather than being treated as a suspect in the proceedings. Reporting duties can arise from rules on corporate governance and company law, depending on a company’s size and other relevant factors (see, notably, the requirement of a status report pursuant to section 243 et seq. of the Austrian Commercial Code). Managing directors of public limited companies must report violations, or their suspicions of violations, of significant impact for the company to the president of the supervisory board, and managing directors of limited liability companies have a corresponding duty to report to the shareholders. Finally, see question 62 for the duty of publicly listed companies to issue ad hoc notifications.

24 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from law enforcement?

See questions 23 and 62.

25 When would management typically brief the board of a company in your country about an internal investigation or contact from law enforcement officials?

Internal reporting duties depend on the form of incorporation of a company. In public limited companies, the management must immediately report to the president of the supervisory board if an important event occurs, including events that receive broad attention in the media (Nowotny in Doralt, Nowotny and Kalss, Aktiengesetz, 2nd edition, section 81, no. 7). In the case of limited liability companies, the shareholders must be informed.

26 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

As a general rule, everyone is under a legal duty not to destroy material that may become relevant in a legal dispute. Suppression of evidence is a criminal offence (section 229, StGB).

Advisable measures include the search and preservation of relevant data and the drawing up of an internal memo recording the findings. Companies should also review the settings of deletion routine and instruct employees not to delete any emails, nor to destroy relevant data.

27 How can the lawfulness or scope of a notice or subpoena from a law enforcement authority be challenged in your country?

Persons suspected of a crime have a right against self-incrimination (see question 18). However, non-compliance with a notice to produce documents or subpoena to appear before the investigation authority may lead to coercive measures, such as house searches. A coercive measure can be challenged by means of a complaint, arguing, for example, that the measure violates the principle of proportionality (section 87, StPO). If documents are protected by attorney–client confidentiality, an objection to the temporary securing can be filed and the sealing of the documents or data can be requested, to obtain a court decision to release the data (see question 17).

Attorney–client privilege

28 May attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

If an attorney is conducting the internal investigation or mandates a third party (see question 35), products such as investigation reports are covered by attorney–client confidentiality (see question 17). It is recommended to store attorney work-product so the data continues to belong to the attorney, for example using only a SharePoint provided by the attorney. In this way, objections and challenges in the case of a house search at a client’s or third party’s premises can be avoided.

29 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

The holder of the confidentiality obligation is the attorney. He or she owes it to the client and the client may release the attorney from the duty. However, attorneys are under no duty to testify. Even if the attorney is released from the duty of confidentiality by the client, he or she still must consider the potential to cause damage to the client when testifying and, if required, refrain from testifying. If, on balance a refusal to testify serves an attorney’s client’s interest better, he or she is under a duty not to testify. The confidentiality obligation applies regardless of whether the client is an individual or a company.

30 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

In Austria, the attorney–client privilege applies only to external counsel.

31 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

There is a general understanding that waiver of the attorney–client privilege is necessary to obtain co-operation credit. However, no legal rule exists that would render a waiver mandatory. As noted under question 29, attorneys may be under a duty to insist on confidentiality even if their client has discharged them from it.

32 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

It is not possible to limit disclosure of information to the prosecuting authority for the whole duration of the proceedings. The prosecuting authority must share relevant information with the parties who have access to the criminal file. It can only grant confidentiality for a limited period but will ultimately have to disclose it.

Accused or suspected persons may release their attorneys with regard to certain aspects of the facts only. As explained under questions 29 and 31, attorneys even if released from their duty of confidentiality are under no obligation to testify.

33 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

There is no legal requirement in Austria to waive attorney–client confidentiality. However, if information is in the public domain, it is no longer protected. If information is made part of the criminal file, the prosecution may restrict access only for a limited time.

34 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Given the fundamental difference between the discovery provisions under Austrian law and those applicable in common law jurisdictions, there is no need for a US-style concept of common interest privilege.

Third parties to whom information was disclosed may not have a duty to keep the information confidential or may not benefit from a right to refuse to testify.

35 Can privilege be claimed over the assistance given by third parties to lawyers?

Where it is necessary for an attorney to resort to third parties (e.g., a forensic or accounting expert) for the purpose of carrying out his or her own mandate, these third parties are considered as assistants of the attorney and information they obtain or the work-product they produce is confidential (section 9, paragraph 3, Law on Attorneys; see also Tipold and Zerbes in Fuchs and Ratz, Wiener Kommentar zur StPO, sections 110 to 115, no. 30).

Witness interviews

36 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes. Based on their duty of loyalty, employees must participate in such interviews (for limitations, see questions 20 and 21). If the interview is conducted by an Austrian lawyer, he or she must refrain from influencing the witness’ future statements.

37 Can the attorney–client privilege be claimed over internal witness interviews or attorney reports in your country?

There is no case law confirming that attorney–client confidentiality covers interviews conducted by or reports drafted by attorneys on the instruction of their client. However, based on the general principles outlined under questions 17 and 28, it must be presumed that such information is protected.

38 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

Any interview has to be conducted within the confines set by law, notably the employer’s duty of care towards employees (see question 20), the protection of privacy, substantive criminal law and data protection law. Data protection law requires, inter alia, the respect of the principle of proportionality in using data. In most situations, recording the interview will require the agreement of the interviewee, but may also be justified by the prevailing interests of the company (section 12, paragraph 2, DSG).

Whether further legal restrictions apply, in particular the right against self-incrimination, is subject to debate in Austria (see question 21). As long as the current legal uncertainty persists, it seems advisable to at least inform interviewees of their potential right against self-incrimination and their right to legal representation. There is no duty of care between a company and third parties who are not employees.

If the interview is conducted by an attorney, the attorney will have to comply with the attorneys’ code of conduct. This requires the attorney to inform the interviewee about the capacity in which he or she is acting and by whom he or she was instructed. Attorneys conducting interviews are, moreover, required to avoid influencing the witness’ future statements.

39 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

Interviews are usually conducted by two interviewers with the help of a questionnaire. It is common that a written record is taken of the interview. Less frequently, interviews are recorded (see question 38). Depending on the circumstances, the interviewee may be presented with documents. Especially in the case of a potential conflict of interest between the interviewee and the interviewer or company, an employee may be accompanied by his or her own legal representative (see question 38).

Reporting to the authorities

40 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

There is no legal duty for private companies to report misconduct to law enforcement authorities. There may be such a duty for state companies exercising sovereign power.

41 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Self-reporting may be advisable in circumstances in which the company can take advantage of a leniency programme, such as through the crown witness regulation (see question 19) or the Diversion procedure, or to gain victim status in the proceedings (as an injured party) rather than facing the risk of accusation.

Diversion in relation to corporations is regulated in section 19 of the VbVG. Pursuant to this provision, the public prosecutor must close a criminal prosecution against a corporation if certain requirements are met. These include that the alleged offence is liable to ex officio prosecution, the facts of the case are sufficiently established (here self-reporting may be essential), the personal culpability of the accused is not grave, the consequences of the alleged wrong­doing was appropriately compensated by the payment of damages, and the punishment of the corporation is necessary neither for reasons of special nor of general prevention.

Moreover, dropping charges pursuant to section 19 of the VbVG is subsidiary to section 18 of the VbVG, which entitles public prosecutors to close a criminal prosecution against a corporation if punishment seems unnecessary considering a number of factors, including the conduct of the corporation after the alleged offence (here self-reporting may again be of particular importance), the seriousness of the alleged offence, the amount of the fine to be imposed, and the detriment suffered by the corporation owing to the misconduct.

To take advantage of the leniency programme, it is important, inter alia, to self-report before the criminal prosecution becomes aware of the alleged misconduct. The disclosure should include all companies and persons who are to benefit from the leniency programme. Owing to the complexity of the procedural rules, it is highly recommended to engage a local lawyer to secure the benefits of such a programme.

In cases involving misconduct in several countries, the advice will have to take into account the principle of ne bis in idem. It is essential to form a strategy considering all countries having criminal or regulatory jurisdiction over the case simultaneously.

42 What are the practical steps you need to take to self-report to law enforcement in your country?

See question 41. In any event, a local lawyer who specialises in business crime law should be engaged before taking any practical steps of self-reporting in Austria. The disclosure can be made anonymously, using, for example, the WKStA’s whistleblowing tool, or openly by providing the name of all involved parties, as is especially the case when seeking leniency.

Responding to the authorities

43 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Companies should immediately inform their attorney of a notice or subpoena and should, in most cases, seek to enter into a dialogue with the law enforcement authority. This will mostly be initiated by calling the authority to arrange a meeting of the company and its attorney at the authority’s offices.

44 Are ongoing authority investigations subject to challenge before the courts?

The only remedy to challenge an ongoing investigation is a motion to terminate the prosecution (Einstellungsantrag), which can be filed with the public prosecutors at the earliest three months after the opening of the investigation (section 108, StPO). The public prosecution may either close the prosecution or pass the motion to the court, with an (optional) statement of its position. Generally, the motion is likely to succeed if it is filed with the blessing of the authority or even if an initial suspicion is lacking. However, if the authority is of the opinion that further facts need to be clarified, the court would usually allow the investigation to continue and dismiss the motion.

45 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

The company may regard the two proceedings as separate and handle them separately. However, a negotiation of disclosure packages with authorities from various countries is advisable, especially if the prosecution teams co-operate closely. In any event, companies are well advised to safeguard consistency.

46 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for and produce material in other countries to satisfy the request? What are the difficulties in that regard?

Companies are not required to search for and produce material, whether they are located in Austria or abroad. Orders for temporary securing of evidence (see question 16) can extend to documents abroad, but require either traditional judicial assistance or, between EU Member States, an EIO (see question 7).

Although there is no obligation, it may be advisable for a company to search for documents and produce them to avoid coercive measures, such as house searches.

47 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

See question 7.

48 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Austrian officials may not disclose any secret entrusted or accessible to them by virtue of their office (section 310, StGB). In practice, leaks to the public are quite common in Austria as soon as a more extensive number of parties have access to the criminal file (see question 32). In addition, in cases of public interest, the authorities are expressly required to keep the public informed (see also question 59 concerning the Media Decree of the Ministry of Justice). This duty to inform compromises the duty of confidentiality to a certain extent.

49 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

If the company does not want to disclose the document, we would advise the public prosecutors that our client is not entitled to disclose the document. If the company prefers to disclose the document, we would inform the public prosecutors that they have to resort to coercive measures based on judicial assistance or an EIO to obtain the document in the country where the document is located (see question 7).

50 Does your country have blocking statutes? What related issues are implicated by complying with a notice or subpoena?

On 7 August 2018, the European Union enacted an updated Blocking Statute to nullify US sanctions on countries trading with Iran, after the US announced sanctions against those countries following its withdrawal from an agreement permitting trade if Iran curtailed its nuclear programme. The 2018 Blocking Statute essentially prohibits companies within the European Union from direct or indirect (via subsidiaries or intermediary persons) compliance with the laws listed in the US Sanctions Annex. It also does not recognise any verdicts by courts that enforce US penalties. Reuters described the Blocking Statute more ‘as a political weapon than a regulation’, since the Blocking Statute’s rules are ‘vague and difficult to enforce’.

Otherwise, the term ‘blocking statute’ is not part of Austria’s legal system. Of course, in cross-border cases, complying with a notice or subpoena in one country may often have implications in other countries. For example, a potential waiver of privilege is an important negative side-effect to consider. We have seen Austrian authorities accept well-argued excuses arising out of restrictions provided by foreign law, such as the potential waiver of privilege.

There is no blocking statute in Austria. However, the applicable data protection law, including the GDPR, must be considered in this regard, as it contains several requirements in connection with the cross-border transfer of data (see questions 13 to 15).

51 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Voluntary production of evidence may expose the management and board members who authorised the disclosure to liability, whereas compelled production entails no exposure to any liability.

As explained in the answer to question 48, third parties with a duly substantiated legal interest may access the file of criminal proceedings, unless conflicting private or public interests prevail (section 77, StPO). Confidentiality therefore only extends to persons who lack a legal interest. The general public may gain knowledge of information contained in the file through the media. The accused, the defence lawyer, victims and third parties entitled to access the file are subject to regulatory restrictions (section 54, StPO) when passing on information obtained from the criminal file, in particular, when passing it on to the media. The media must take due account of the presumption of innocence when using the evidence and respect data protection laws (see question 50). Officials are under a duty of confidentiality (see question 48).

Global settlements

52 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Austrian law does not allow for settlements with law enforcement authorities. Under very limited terms, it is possible to resolve criminal prosecution by Diversion (see question 41) or to benefit from the crown witness regulation (see question 19).

53 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

Pursuant to the VbVG, corporations are subject to fines, which are measured in per diem units, and to court directives (e.g., to compensate for harm done or to implement a proper compliance system). The current maximum fine for companies amounts to €1.8 million (depending on the corporation’s earnings). Moreover, they can be ordered to make redress, most notably in the form of compensation for harm done and charity donations. The corporation cannot be indemnified by directors, officers or employees for fines imposed against the corporation (section 11, VbVG). However, the company may pursue its representatives for damage arising from breach of their employment duties.

Natural persons are subject to the whole set of penalties and other sanctions if they are found (personally) guilty of an offence (section 18 et seq., StGB).

54 What do the authorities in your country take into account when fixing penalties?

Section 5, VbVG contains a non-exhaustive list of aggravating and mitigating factors. Aggravating factors include gravity of harm done by the corporation, benefit flowing from the offence for the corporation, and toleration or facilitation of misconduct by employees. Mitigating factors include preventive measures taken by the corporation prior to the offence, including directives to adhere to the law issued to the employees, the employees being solely responsible for the offence, the contribution to the resolution of the case, compensation of harm done, essential measures to prevent future offences, and significant economic detriment to the corporation. The sentencing of natural persons follows similar principles (section 32, StGB).

55 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Non-prosecution agreements are not available in Austria. For the dropping of charges through Diversion and closure of proceedings pursuant to section 18, VbVG, see question 41. A closure of a criminal prosecution by Diversion has the advantage that the corporation is not condemned and no entry is made in the criminal register for corporations. The amount paid as a fine is also inferior to the fine imposed in the case of a conviction for the same offence.

56 Is there a regime for suspension and debarment from government contracts in your country? Where there is a risk of suspension or debarment or other restrictions on continuing business in your country, what are the options available to a corporate wanting to settle in another country?

Pursuant to the Federal Law on Public Tenders (BVergG), a company can be excluded from public tenders if one or more of its managers are convicted of an offence that casts doubt on any of the managers’ professional reliability. Companies participating in a public tender must provide proof of professional reliability by submitting criminal records issued by their home country (section 72, paragraph 2, BVergG). However, a company may establish that notwithstanding such a reason for exclusion, its professional reliability is guaranteed, notably by implementing measures preventing future offences.

57 Are ‘global’ settlements common in your country? What are the practical considerations?

Global settlements are not common in Austria. For the effect of a Diversion in EU Member States, see question 5.

58 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

Under Austrian law, private parties may declare a joinder of their civil claims to the criminal proceedings (section 67, StPO). Private plaintiffs who make a joinder declaration may access the criminal file insofar as their interests are affected (section 68, StPO).

Publicity and reputational issues

59 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Investigations are not public in Austria (section 12, StPO). In cases of public interest, the prosecutor is asked to inform the public about the status of an ongoing investigation through the larger courts’ and public prosecutors’ media offices. The co-operation of the prosecution authorities and courts with the media is governed by the Media Decree of the Federal Ministry of Justice JMZ 4410/9-Pr 1/2003, dated 12 November 2003.

Main trial and appeal proceedings are public (section 12, StPO), but may neither be broadcast on the radio or television, nor recorded by audio or visual recording (section 228, paragraph 4, StPO). In cases of public interest, it is common to have online live news ticker reporting. There are some exceptions to the principle of the public nature of the trial, including for reasons of public policy or to safeguard legitimate interests of the accused, witnesses or third parties.

However, the criminal file, is only accessible to the accused and his or her defence lawyer, victims, private plaintiffs, and parties with a duly substantiated legal interest (section 77, StPO; see questions 51 and 58).

60 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

It is common to use public relations (PR) firms. The author strongly recommends using PR firms specialised in litigation PR and crisis management.

61 How is publicity managed when there are ongoing, related proceedings?

The PR strategy should not only focus on managing the criminal trial, but also include all aspects of the legal matter, including (potential) civil liability matters.

Duty to the market

62 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Pursuant to section 48d of the BoerseG in conjunction with the Market Abuse Regulation (Regulation (EU) No. 596/2014), companies publicly listed at the Vienna Stock Exchange must issue ad hoc notifications regarding inside information, namely information that has not been made public and, if it were made public, would be likely to have a significant impact on the price of the company’s shares or other related financial instrument. Under certain circumstances, immediate disclosure can be delayed, in particular if it would impair the company’s interests, the public is not misled and the fact that a settlement has been reached can be kept confidential to the point of its intended disclosure (see article 17(1), Market Abuse Regulation).

Footnotes

Bettina Knoetzl is a partner at KNOETZL. She thanks Thomas Voppichler, counsel at KNOETZL, and Beatrice Bachl, associate at KNOETZL, for their highly appreciated assistance.