What does the new whistleblowing system entail?
In line with Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law, the Hungarian Parliament adopted a new law on complaints, whistleblowing and rules for reporting breaches, which replaces previous legislation. Below we have summarized the key points of the new rules. This information has been prepared for private sector actors.
The new law establishes a three-stage reporting system in line with EU requirements:
- the first stage is the so-called internal reporting channel, which refers to the reporting of the breach within the entity;
- the second stage is the so-called external reporting channel, whereby the whistle-blower communicates the breach to the competent national authority designated by the Member State;
- the third stage is the public disclosure of the breach.
Of these, it is the so-called internal reporting channel that employers are obligated to establish.
What kinds of employers are required to set up an internal whistleblowing channel?
The provisions are applicable
- from the 60th day after promulgation for employers with 250 or more employees;
- from the 60th day after promulgation for certain employers to whom specific legislation applies (e.g. money laundering law), irrespective of the number of employees;
- from 17 December 2023 for employers with at least 50 but no more than 249 employees.
Employers with fewer than 50 employees, to whom the above obligation is not applied, may set up such a system on a voluntary basis.
To summarise, all employers with at least 50 employees, and in certain sectors regardless of the number of employees, should establish an internal whistleblowing reporting channel. The latter category includes, for example, service providers subject to the money laundering law.
It is important that employers with at least 50, but no more than 249 employees, be able to set up the whistleblowing system jointly, which could simplify the process significantly, particularly for employers in a joint group of companies.
Who should operate the internal whistleblowing channel?
In essence, there are two ways the channel may be operated:
- By a person or department designated for this purpose by the employer, who cannot be instructed in this task, which means that employees in other job positions may also perform this function, subject to training and appropriate contractual guarantees.
- By an external whistle-blower protection lawyer or other external third party, in which case the requirements and safeguards will of course apply to the whistle-blower protection lawyer or other external third party as well. This option eases the burden on employers, as they do not have to ensure the operation of the whistleblowing reporting channel within their own organization and by their own staff.
Who is entitled to make a report?
The new law contains a broader list than the current Complaints Act, taking into account that it is appropriate to extend the range of persons who despite not being employees, could play a key role in the detection of breaches and may find themselves in an economically exposed position in relation to their work-related activities. In addition to employees, other persons who are entitled to report breaches include former employees, persons with whom the procedure for the establishment of an employment relationship has been initiated, interns, volunteers, self-employed persons, sole proprietors if they have a contractual relationship with the employer, employer shareholders and members of the employer’s administrative, management or supervisory board, including non-executive members.
In which cases can a report be made?
Unlawful or allegedly unlawful acts or omissions, or other breaches, may be reported. Pursuant to the current legislation, employers can set rules of conduct for their employees to protect the public interest or significant private interests. In the event that the employer has laid down said rules of conduct, any breach of these rules may also be reported. Such rules of conduct must be made public in advance in order to ensure that the restrictions on employees’ rights do not go beyond what is strictly necessary and proportionate, and to ensure that the rules of conduct are communicated to a wider audience.
How are reports made?
A report can be made in writing or orally by telephone; through other means capable of reproducing the communication, or in person.
Employers can decide for themselves the specific type of internal reporting channel they want to set up. Examples include postal channels, actual complaint boxes, online platforms – intranet or internet and telephone hotlines – provided that the confidentiality of the identity of the whistle-blower is guaranteed. An important point for compliance is how the channel is set up by the employer.
How should reports be investigated?
The new law is based on the existing rules for the employer whistleblowing system under the Complaints Act, making it easier for employers who already operate said system to comply with the law.
The employer is obligated to:
- send an acknowledgement of receipt of the written report to the whistle-blower within 7 days of receipt;
- provide the whistle-blower with general information on the procedural and data protection rules under the act in the context of the acknowledgement;
- investigate the allegations in the report within the shortest time possible under the circumstances, but no later than 30 days from the receipt of the report.
In particularly justified cases, the investigation may be extended, but in no case should it exceed 3 months.
What could be potential consequences?
The investigation shall include the assessment of the relevance of the circumstances set out in the report and the adoption of appropriate measures to remedy the breach. If, based on the report, initiating criminal proceedings is needed, a police report should be filed. If the investigation reveals that the conduct in the report is not a criminal offence, but violates the employer’s rules of conduct, the employer may take employer action in accordance with the rules governing the employment relationship.
Data protection
The protection of personal data is particularly important because, if it is not guaranteed, it may discourage whistle-blowers from reporting breaches.
Beyond the protection of whistle-blowers’ personal data, there should also be safeguards in place for those individuals that are the subject of reports, as they may be adversely affected by a lack of protection of their personal information.
The scope of the personal data that is processed is determined by the data controllers. Only data strictly necessary for the investigation of the report may be processed for this purpose.
To do’s
Employers to whom the legislation applies should establish an internal reporting channel or, where one is already in operation, review it to ensure compliance with the new provisions.
By Barnabas Buzási, Counsel and Head of Employment and Data Protection, and Helga Szkok, Associate, Wolf Theiss
