Whistleblower protection and reporting channels in Hungary

To ensure legal compliance with the provisions on the establishment and operation of an internal whistleblowing system, Directive 2019/193 of the European Parliament and of the Council of 23 October 2019 on the protection of whistleblowers (the Whistleblowing Directive) has been transposed into Hungarian law in the new Act XXV of 2023 on complaints, whistleblowing and rules related to whistleblowing (the Hungarian Act). The Hungarian Act will enter into force on 24 July 2023.

The Hungarian Act must be applied from the following dates:

1. 24 July 2023 by employers with at least 250 employees.
2. 24 July 2023 by employers falling under the scope of the AML provisions, etc. (see question 2).
3. 17 December 2023 by employers with at least 50 but no more than 249 employees.
4. 24 July 2023 by any employer that has been using a whistleblowing reporting process according to the old Hungarian whistleblowing act – the complaints and reports submitted to the employers on the basis of the old Hungarian act and not closed until 24 July 2023 must be managed and decided upon in line with the new Hungarian Act (except for the employers under point b above). 

Under the Hungarian Act, companies are required to set up an internal abuse-reporting (whistleblowing) system whereas previously this was only an option. The new legislation sets out more detailed obligations on several issues compared to the provisions of the previous Act CLXV of 2013 on complaints and notifications of public interest.

The following laws continue to apply in addition to Hungarian Act:

• Act CXXII of 2009 on the more economical operation of publicly owned companies – Section 7/J of the Act makes it compulsory for a certain publicly owned companies to operate an internal control system (e.g. companies with a main balance exceeding HUF 600 million or companies where the net annual income exceeds HUF 1.2 million, etc.).
• Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (AML Act) and MNB Decree 26/2020 (VIII.25.) (referred to here as the Decree) – this is a sectoral law for anti-money laundering and terrorist financing. Section 30 of the AML Act in conjunction with Section 38 of the Decree obliges credit institutions, financial service providers, occupational pension institutions, voluntary mutual insurance funds, fiduciaries, lawyers, among others (as described below) to operate a whistleblowing system. Anyone who is aware that a service provider is or has breached a provision of the Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing is entitled to file a report.

The Hungarian Act requires that all employers with at least 50 persons under any legal type of employment relationship establish a whistleblowing system.

Regardless of the number of employees, the following employers are required to operate an abuse-reporting system:

• a service provider within the meaning of the AML Act (amendment to the Hungarian Act is underway and will create exceptions for sole practitioner attorneys at laws, sole member law firms);
• an employer registered in Hungary and carrying out offshore oil and gas activities as a licensee or operator outside the EU;
• an employer covered by Regulation (EU) No. 376/2014 of the European Parliament and of the Council on the reporting, analysis and monitoring of civil aviation occurrences;
• the operator of a Hungarian and non-Hungarian flagged floating installation operating in Hungary.

Compliance with the obligations for establishing a reporting system/channel will be monitored by the employment monitoring authority. In the event of a breach of this obligation, the provisions of Act CXXXV of 2020 on services and subsidies to promote employment and on employment supervision will apply, except that there will be no fines or prohibition from engaging in any activity.

Act II of 2012 on Administrative Offences, Administrative Offences Procedure and the Administrative Offences Registration System has been amended. According to the amendment, anyone who takes negative action against a whistleblower or obstructs or attempts to obstruct the filing of a whistleblower report commits an administrative offence under Hungarian law. 

According to Section 401 of Hungary’s Act No. 2012/C on the Criminal Code, failing to comply with the reporting obligation prescribed by the law in connection with the prevention and combating of money laundering and terrorist financing qualifies as a misdemeanour punishable by imprisonment not exceeding two years.

The main obligations for businesses under the Hungarian Act are as follows:

• They must designate a person or department to manage and investigate the report and operate the whistleblowing system, which must be impartial. This designated person or department must work with an impartial whistleblower protection lawyer or another external body that complies with conflict-of-interest rules.
• The report can be made in writing or orally by phone, by a recorded voice messaging system or in person. An oral report made by phone must be recorded electronically or in writing and handed over to the reporter. At the same time, a record must be made.
• The whistleblower must be informed within seven days of receipt of the written report.
• Reports must be investigated within 30 days, which may be extended to a maximum of three months with appropriate information.
• Investigations of reports must include measures to remedy the abuse, the filing of a complaint if criminal proceedings are warranted, and employer action.
• The whistleblower must be informed of the investigation or if no action taken will be taken, and must be informed of either the outcome of the investigation or the reasons for the non-notification and the action taken in response.
• The personal data of the whistleblower must not be disclosed. This individual's identity must be protected and only the investigator of the whistleblower's report can have access to it.
• The reported person affected by the report must be given the opportunity to make his or her views known and to submit evidence, including through legal representation.
• A report doesn’t need to be investigated if the whistleblower cannot be identified, the report was made by an unauthorised person, the report is a repetition of a report previously made, or the investigation of the report would disproportionately restrict the rights of the reported person affected by the report.
• Strict data protection rules must be complied with:
  • Only data strictly necessary for the investigation of the report can be processed; other data must be deleted.
  • The data can only be passed to specific categories of persons and must be deleted after the investigation is completed, unless action is taken on the basis of the report in which case the data can only be processed until the final conclusion of the proceedings that were initiated.
  • If the right of access under the GDPR is exercised, the whistleblower's personal data cannot be disclosed.
  • The personal data of the whistleblower and the notified person can be disclosed only to the person examining the report (who is authorised to do so), but to the extent necessary for the examination, the data contained in the report and the data of the notified person can be disclosed to other departments, but not to the whistleblower.

If there is an active works council at the employer, it must be informed of the establishment of a whistleblowing system in accordance with Section 264 of Hungary’s Act No. 2012/I on the Labour Code (the Labour Code). Also, the works council may initiate consultations concerning the establishment of the system. Therefore, we suggest that employers launch consultations so that works councils cannot initiate these at a later stage. (A works council cannot prevent the employer from the implementation of a system, but a consultation may delay the start date.)

The employee has a general confidentiality obligation towards the employer. 
This overall principle works in two ways: 1) the obligation to report irregularities internally; and 2) not to disclose certain information to the public:

1. Under Section 6(4) of the Labour Code, the employee must inform the employer of all facts, information, circumstances, and any changes therein, which are considered essential from the point of view of employment relationship and exercising rights and fulfilling obligations as defined in the Labour Code.
2. On the other hand, Section 8(1) of the Labour Code prescribes that employees must not engage in any conduct, which jeopardises the legitimate economic interests of the employer. In addition, Section 8(4) expressly states that employees must maintain confidentiality in relation to business secrets obtained in the course of their work and must not disclose to unauthorised persons any data acquired in connection with their activities that, if revealed, would result in detrimental consequences for the employer or other persons.

According to the Hungarian Act, any negative action taken against the whistleblower because of the lawfulness of the report taken in the context of or in connection with an employment relationship is unlawful, even if it would otherwise be lawful.

A negative action is an act or omission that is harmful to the whistleblower, in particular but not exclusively:

• suspension, collective redundancy, dismissal or equivalent measures;
• demotion or denial of promotion;
• transfer of duties, change of place of work, reduction of remuneration, change of working hours;
• refusal to provide training;
• negative performance appraisal or job reference. 

In addition, the dismissal rules under Hungarian labour law strictly regulate the reasons for dismissal communicated by the employer, according to which the reason for dismissal must be clear, real, causal and timely. These rules provide strong protection for whistleblowers.

Regulation 2016/679 (EU) (the General Data Protection Regulation or GDPR) must be complied with. The processing of personal data must have a valid legal basis and cannot be processed for purposes other than investigating the report or complaint.

Pursuant to the Hungarian Act, at the beginning of the investigation, when issuing a report, the whistleblower must be informed in detail of his or her rights regarding the protection of his or her personal data and of the rules governing the processing of this data.

In addition, in the case of anonymous reporting, special attention should be given to preserving the anonymity of the whistleblower (e.g. by providing a secure technical method that protects the identity of the whistleblower, or the use of an external whistleblower system that is separate from the organisation’s internal IT environment).

For confidential reporting, the whistleblowing system must be designed in such a way that the identity of the non-anonymous whistleblower is only accessible to the investigators of the report. Until the investigation is closed, or formal prosecution is initiated as a result of the investigation, the investigators must keep the data on the identity of the whistleblower confidential and must not share it with any other department or staff member of the employing organisation, except for the purpose of informing the whistleblower.

Furthermore, within the organisation, the persons absolutely necessary for conducting the investigation can become aware of the personal data of the whistleblower.

The personal data that is not necessary for investigating the report must be immediately deleted.

The whistleblower’s personal data cannot be accessed by any other data subject (including by the person reported).

According to the Hungarian Act, employers that employ at least 50 and up to 249 persons may jointly set up a whistleblowing system, irrespective of whether they are the members of the same company group.

Employers employing at least 250 employees need to set up their own whistleblowing system.