Information obligation vs. protection of confidentiality – Criminal law aspects of the Freedom of Information Act

On September 1, 2025, as reported here, the Freedom of Information Act (IFG) came into force. What politicians themselves have called a “paradigm shift” from official secrecy to proactive disclosure obligations and the right to access information also raises questions about criminal law risks and obligations for those potentially subject to disclosure obligations.

Parallel to the entry into force of the IFG, legal adjustments were also made in the area of criminal law protection of secrets.

In order to ensure that civil servants continue to be bound by their official duties of confidentiality, the provisions of Section 310 of the Austrian Criminal Code (StGB) were comprehensively amended. The prohibition of “breach of official secrecy” became the prohibition of “breach of a duty of confidentiality.” The background to this is that even after the IFG came into force, there are still important reasons for confidentiality (see Section 6 (1) IFG), compliance with which is to be ensured by the threat of criminal sanctions.

If a (former) civil servant discloses or exploits official information that he or she is legally obliged to keep confidential, this may result in criminal sanctions. The prerequisite for criminal liability is that the action poses a concrete threat to the public or private interests specified in Section 6 (1) IFG. As emphasized in the decree of the Ministry of Justice, the threshold for criminal liability has thus been raised, but the disclosure of information contrary to the requirements of the IFG can (continue to) have criminal consequences.

In this context, it should be noted that civil servants who are subject to a statutory duty of confidentiality continue to be subject to an absolute prohibition on testifying in criminal proceedings, unless they are released from their duty of confidentiality (Section 155 (1) lit. 2 StPO). However, private-law confidentiality obligations, such as confidentiality clauses, do not constitute grounds for a prohibition on questioning.

With regard to the scope of application of Section 310 of the Criminal Code, it should be noted that this is based on the definition of a civil servant in Section 74 (1) lit. 4 of the Criminal Code, which is to be interpreted purely functionally. Accordingly, only the function performed is decisive, not the employment relationship.

However, the information obligations under the IFG do not only apply to administrative bodies, but go far beyond this and also include, in particular, foundations, funds, institutions, and enterprises (private entities subject to information obligations) that are subject to control by the Court of Auditors or a provincial court of auditors.

In this context, it should be noted that even outside the scope of Section 310 StGB, violations of confidentiality obligations can be prosecuted and numerous substantive laws provide for corresponding sanctions.

For example, Section 121 StGB sanctions the disclosure or use of health-related information by certain professional groups. The unlawful disclosure or use of trade secrets is punishable under Sections 122 StGB and 11 UWG. Copyright law also provides for criminal sanctions (Section 91 UrhG). The use, disclosure, or publication of personal data contrary to legitimate confidentiality interests may in turn be sanctioned under Section 63 of the DSG.

Last but not least, the unlawful publication or disclosure of information worthy of protection may result in civil liability, whether on the basis of tortious claims for damages or contractual claims (e.g., contractual penalties).

Requests for information under the IFG do not, by their very nature, constitute a “carte blanche” to disclose information and documents. Although the IFG itself does not provide for any criminal sanctions in connection with the (non-)disclosure of information, there are still extensive confidentiality obligations under substantive laws, the violation of which can, in the worst case, have criminal consequences. Therefore, we can only warn against using (unjustified) requests for information as a justification for disclosing information.

Please note: This blog is for general information purposes only and in no way constitutes legal advice from Binder Grösswang Rechtsanwälte GmbH. The blog cannot replace individual legal advice. Binder Grösswang Rechtsanwälte GmbH accepts no liability of any kind for the content and accuracy of the blog.