On 25 May 2023, Act XXV of 2023 on Complaints and Whistleblowing and on the Rules Relating to the Reporting of Abuses (“Complaints Act” or “Act“) was published in the Hungarian Gazette, implementing the Directive 2019/1937 on the protection of persons reporting violations of EU law, i.e., the “Whistleblowing” Directive (“Directive“) into the Hungarian law. The Act has introduced the internal whistleblowing system, which allows employees (including future and former employees), contractors and owners to report information on any abuse to the system in place at the company.
Who is required to set up an internal whistleblowing system and when?
The Complaints Act will be introduced in two steps.
From 24 July 2023, the following companies will have to comply with the rules:
- companies with at least 250 employees;
- service providers covered by the AML Act, such as estate agents, accountants, auditors, tax advisors, lawyers, head office service providers.
Companies with at least 50 but no more than 249 employees will have to comply with the provisions of the Act from 17 December 2023. An additional relief for such medium businesses is the possible creation of a common internal whistleblowing system, reducing the administrative burden.
What are the basic obligations for employers when setting up internal reporting channels?
- Appointment of a responsible person: companies that set up an internal whistleblowing system must designate an impartial person or department, or contract with an external organisation, a whistleblower lawyer, to operate the system.
- Making a policy: in view of the Act, it may be essential to review existing policies and possibly amend related internal procedures (e.g. the data protection policy).
- Disclosure: To ensure that persons entitled to report abuse are aware of the internal whistleblowing system, companies should provide adequate information on the procedures.
- Record keeping: in order to enable the company to decide whether to disregard a notification on the grounds that it has already been examined or that it was received after the time limit specified in the Act, it is necessary to keep accurate records of all notifications received.
What are the consequences, if someone does not meet the requirements?
Compliance with the obligations related to the operation of the whistleblowing system will be monitored by the Hungarian employment supervisory authority. The authority may take the following decisions:
- issue a warning,
- oblige the employer to remedy the infringement, the shortcoming or the failure to fulfil the employment obligation,
- prohibit the continued employment of an employee who has committed an infringement until the infringement has been corrected, if the infringement or its likely consequences are serious and the infringement cannot be remedied within a short time.
When setting up and operating an internal whistleblowing system, all businesses should pay particular attention to strict data protection rules. Failure to comply with data protection rules can result in financial penalties in the event of action by the national authority for data protection.
What are the potential challenges of the new requirements?
Studying the Act raises a number of practical questions, but we believe that solutions can be found. Below are a few issues that every company should consider.
Not all notifications must be checked by the employer, and there may be several cases where an investigation can be waived, such as:
- the notification was made by an unidentified notifier,
- the notification was not made by the person entitled to do so,
- a repeated application was handed in by the same applicant with the same content as the previous application, or
- the harm to the public interest or to an important private interest would not be proportionate to the restriction of the person’s rights concerned by the notification resulting from the investigation of the notification.
The employers also have to question, whether it is necessary to notify another authority or to take any further action, either when a criminal offence is suspected or in a less obvious case where a request to the competition authority is justified.
Companies must be prepared for the challenges of protecting trade secrets and data protection when registering and recording whistleblowers and incident reports. Too little information collected can impact the success of an investigation, while too much information can raise privacy concerns. So there is a need to find a middle path where sufficient, but not too much information is available to companies. The quality of the information flow should also be taken into account in the communication with the whistleblower and the persons affected by the notification, as the Act imposes a number of information obligations on companies, but the detail level of the notification issued is not indicated.
Under the Complaints Act, companies are obliged to refrain from taking any detrimental action to the whistleblower, if it is related to the complaint. Such adverse action may include, inter alia:
- termination;
- a demotion or refusal to promote;
- delegation of tasks;
- negative performance assessment or job references;
- failure to renew or early termination of a fixed-term employment contract.
If a company applies any of those measures to an employee and the employee challenges them in court, the company must be able to prove that there was another legitimate reason for its decision.
Several groups, mainly with an international background, have already set up internal whistleblowing systems following the entry into force of the Directive. As the published text of the Act sets out requirements that are stricter, Hungarian subsidiaries that already have a whistleblowing regime in place will need to review their procedures.