Hungarian implementation of the EU Whistleblowing Directive

Just after Easter, on 11 April 2023, the Hungarian Parliament adopted its long-awaited act (“Whistleblower Protection Act”) to implement the EU Whistleblowing Directive ((EU) 2019/1937, the “Directive”). The Directive aims to improve protection for whistleblowers across Europe, including by requiring companies to set up internal reporting channels.

For the most part, the Whistleblower Protection Act implements the provisions of the Directive, but in some points it deviates from or goes further than the Directive.

This summary focuses on the key requirements of the Whistleblower Protection Act in corporate practice.

Number of employees or field of business is the decisive criterion

The Whistleblower Protection Act contains an obligation for the following companies to set up internal reporting channels:

• Employers having at least 50 employees. Based on the Whistleblower Protection Act, natural persons who perform an activity for remuneration and under the direction of the company (e.g. apprentices, hired workers, contractors) are also to be regarded as employees.
• Companies in special areas regardless of their number of employees. This includes credit institutions, financial services companies, auditors, bookkeepers, tax advisors, law firms, companies carrying out an activity related to real estate transactions, companies in the oil and gas sector and operators of floating installations in the territory of Hungary.

Companies with 50-249 employees are permitted to share resources by means of a joint internal reporting channel (hotline).

Even companies with fewer than 50 employees should consider voluntarily establishing whistleblower structures to avoid reputation-damaging external leaks (which are also protected by the Whistleblower Protection Act).

Whistleblowers and whistleblowing subjects

A whistleblowing report may be made by (i) prospective, current or former employees, (ii) prospective, current or former self-employed persons having a relationship with the company, (iii) prospective, current or former shareholders and persons belonging to the administrative, management or supervisory body of the company, (iv) prospective, current or former interns or volunteers and (v) contractors, subcontractors or suppliers having a contractual relationship with the company. Companies have no obligation to allow, i.e. investigate, anonymous tips.

The internal reporting channels (hotlines) must be available for any unlawful or allegedly unlawful activities, omissions or other information related to an abuse.

The reporting person must not suffer any adverse measures (e.g., termination of employment, discrimination or any detrimental legal consequences) as a result of the reporting.

Organisational requirements

The whistleblowing hotline must be operated by an independent and competent person or department. The Whistleblower Protection Act does not prohibit the performance of other tasks i.e. operating the whistleblowing hotline can be one of several tasks of the dedicated person or department.

Outsourcing the internal whistleblowing channel to whistleblower protection attorneys or to third-party organisations is permissible. However, operating the hotline and taking necessary follow-up steps may not be completely outsourced to third parties (no transfer of responsibility to third parties). The original responsibility for maintaining confidentiality in handling the whistleblowing report and for remedying the infringement always remains with the obligated employer. Close coordination is therefore required between the employer and the third party, for example with regard to internal investigations and measures to remedy the grievance.

Requirements regarding reporting channels

The Whistleblower Protection Act contains several mandatory procedural requirements for operating internal reporting channels. Among others, companies are obliged to

• offer the option of whistleblowing in writing or verbally,
• check the pertinence of the subject of the report and the validity of the allegations made, contact the whistleblower and, if necessary, request further information,
• maintain the confidentiality of the whistleblower and the person/people affected by the whistleblowing,
• comply with documentation obligations, including recording the content of the verbal reports in writing and acknowledging receipt of the whistleblowing report within seven days,
• take follow-up measures (e.g. internal investigation, discontinuation of investigation, forwarding the information to authorities),
• give feedback to whistleblowers on the outcome of the investigation, the follow-up steps planned and already taken as well as reasons for these within three months of receipt of the report,
• provide information on the operation of its own reporting channel, the related procedure and the main provisions of the Whistleblower Protection Act in an easily accessible manner. In practice, this means that a policy on the operation of the internal reporting channel is to be prepared and communicated by e-mail or on the company’s website.

Data protection requirements

Operating the internal reporting channel (hotline) involves processing the personal data of both the reporting person and the person affected by the whistleblowing. The company operating the internal reporting channel, as a data controller, must prepare a privacy notice on the data processing regarding the operation of the hotline system and communicate it to the data subjects (reporting persons, persons affected by the whistleblowing).This data processing activity must also be included in the company’s register of data processing activities.

The Whistleblower Protection Act strictly regulates permissible processing purposes, the recipients to whom the personal data can be transferred and the deletion obligations of the controller. Special rules apply to the transfer of the personal data to non-EU countries.

Effect of the Whistleblower Protection Act

The Whistleblower Protection Act enters into force 60 days after its publication (which has not yet occurred). At the moment we envisage that the whistleblowing systems will have to be in operation as of the beginning of July 2023.

The Whistleblower Protection Act contains a grace period for companies with 50-249 employees that are obliged to operate the internal reporting channel based on the number of their employees and not on their special activities. The obligation to establish a reporting channel will only apply to them from 17 December 2023.

Legal consequences of the failure to comply with the Whistleblower Protection Act

Failure to set up an internal whistleblowing hotline will not lead directly to an administrative fine. Although the competent labor inspectorate is entitled to check whether the requirements of the Whistleblower Protection Act are being met, in case of non-compliance it may only oblige the companies to comply with the relevant whistleblowing provisions.