Member Article

Zoltan Balazs Kovacs prepared a summary to the key questions regarding the EU Whistleblowing Directive and the related change of legislation in Hungary with the act entering into force on 24 July 2023.

1. Will this legislation apply to businesses with fewer than 50 employees?

Businesses with fewer than 50 employees will be exempt (except for employers that qualify as service providers for the purposes of the Act on Money Laundering and certain employers active in the sea oil and gas industry, civil aviation industry or floating facilities industry, who will be required to set up a reporting channel regardless of the number of their employees).

 

2. Can the internal reporting channel be outsourced?

Yes, however, an entity that has a contract for work or alike or has had a contract for work or alike within the previous 5 years with the entity wishing to establish the whistle-blowing hotline may not be the operator of the reporting channel and may not be involved in the investigation.

 

3. Is there any statutory obligation to provide whistleblowers with any information about the internal and/or external reporting channels? If so, must this information be given in Hungarian?

Yes, such information must be given. There is no specific mention in the Act of any language requirement. Pursuant to the Act, the information must be clear and easily accessible and we understand that the information has to be available (also) in Hungarian.

 

4. Is there a mandatory procedure that companies will need to follow once a report is filed?

When a report is made verbally, certain recording (via audio means or, respectively, in writing, i.e. taking minutes) obligations apply. In case of a verbal report, the whistleblower must be informed of the consequences of making a report in bad faith, of the procedural rules of the investigation and of the fact that his/her identity will be treated confidentially. If the report is made in writing, a confirmation on the receipt of the report must be sent within 7 days. Along with the confirmation, information must be given of the procedural as well as data processing rules.

The report must be investigated within 30 days, which may be extended only in particularly justified cases and even in case of an extension, the duration of the investigation may not exceed 3 months.

The investigation of the notification may be rejected in certain cases (e.g., if the whistleblower has made the notification in a way that he/she cannot be identified, or the notification is a repeated notification by the same whistleblower with the same content).

The reporting system must be designed in such a way that the identity of the non-anonymous whistleblower, the incriminated person and any person who may have credible information of the reported act cannot be known to anyone other than the investigators. The Act also contains certain rules on data processing.

The operator of the system must inform the whistleblower in writing of the inspection of the report (the rejection of the inspection and its reasons), the result of the inspection and of the measures taken.

 

5. What are the works council’s or other representative bodies’ participation rights in respect of whistleblowing systems?

The employer is required to ask for the opinion of the works council (if any) at least 15 days before making a decision on any employer measure affecting a larger group of employees. The opinion of the works council is not binding, however.

 

6. Which categories of persons can be whistleblowers in Hungary?

The circle of such persons is quite broad and it includes persons and entities, such as employees, former employees, potential employees (i.e. job applicants), contractual partners, former contractual partners, potential contractual partners (i.e. when the parties are in negotiation), the owner of the employer, board members and supervisory board members of the employer, apprentices and volunteers.

 

7. Can reports be anonymous?

Yes.

 

8. What protection will be afforded to whistleblowers under Hungarian legislation? Does that protection still exist if the disclosure is determined to be without merit or if the report was maliciously made?

The main rule is that no negative consequence of any kind may be applied due to the making of the report (it does not matter if the report will have turned out to be without any grounds). However, if it has become apparent that the whistleblower has communicated false and decisive information in bad faith, no protection applies and depending on the circumstances of the case, his/her data must or can be handed over to the competent body (e.g. it must be handed over to the competent investigative authority if there is suspicion of a crime).

 

9. How should the employer deal with persons named in the report?

Upon the start of the investigation, the incriminated person (and any person who may have credible information of the reported act) must be informed of the report, his/her data protection rights and the rules of data processing. Exceptionally, if so justified by the investigation, such information can be given at a later date.

The incriminated person (and any person who may have credible information of the reported act) must be given the opportunity to express his/her opinion of the report (via their legal representative, as the case may be).

 

10. Does the Hungarian whistleblowing legislation create offences for non-compliance and what penalties do such offences attract?

The employment authority (which is in charge of monitoring compliance with the Act) may not impose a fine or ban the entity from being engaged in its activities if, for example, the entity fails to set up the reporting system. However, applying a negative consequence against the whistleblower due to the report or preventing or attempting to prevent anyone from making a report qualifies as an offence. A fine amounting to HUF 150,000 (about EUR 400) may be imposed for such offence.

 

11. Are there any other practical steps that companies can take to prepare for the new whistleblowing regime?

A whistleblowing policy (containing material and procedural rules) and the respective privacy policy need to be prepared, and a competent person/body in charge of receiving/investigating the reports has to be designated within the organisation (or an external person/body has to be engaged for such purpose).

 

 

 

 

 

Link to article