New whistleblower regulation in Hungary

The Parliament adopted a new law on complaints, public interest reports, and rules related to the reporting of abuses (the “Whistleblower Protection Act”). The legislation fulfills Hungary’s harmonization requirement to comply with EU Directive 2019/1937. on the protection of persons who report breaches of Union law (the “Directive”).

1. Obligation to establish internal reporting channel

The Directive and the Whistleblower Protection Act cover certain legal entities of both the public and private sectors, which must ensure the operation of the channel for reporting legal violations and the monitoring of reports. Based on the Directive and the Whistleblower Protection Act, natural persons who report information about a violation of law acquired in connection with their work-related activities are considered to be reporting persons. The Directive interprets employment broadly, including all legal relationships in which the employee performs activities for and under the control of the employer in return for consideration, including those who are self-employed.

The Whistleblower Protection Act defines the internal reporting channel according to the Directive as the so-called “internal reporting system”. This internal reporting system is mandatory for all employers who employ at least 50 people in the framework of employment related legal relationship, or, irrespective of the number of employees, the employer which is under the effect of the money laundering act. In the case of employers who employ 50-249 workers, they have the opportunity to share the internal reporting system. Employers having 50-249 workers must establish this internal reporting system by December 17, 2023 at the latest.

2. Procedural obligations

The internal reporting system can be operated by a person or organizational unit designated for this purpose at the employer. Such a person or organization can be the compliance area, the HR manager, the financial manager, the company manager or even the managing director.

The subject of the report may be any information about an illegal or suspected illegal act or omission, or other abuse. The reporting at the employer can be made not only by the employee, but also by the person whose legal relationship has already been terminated, a person who wishes to establish a legal relationship or for whom the procedure for establishing this legal relationship has already begun (e.g. a person applying for a job application). An individual entrepreneur, subcontractor, owner, trainee working there, volunteer who has a contractual relationship with the employer can also file a report, even if the legal relationship has already ended or if they want to establish a contractual relationship and this procedure has already started. So the possible scope of the reporting persons is interpreted broadly by the law, almost anyone who had, is or will be in a contractual relationship with the employer can make a report.

The report can be made in writing or orally (by phone, voice message or even in person). Employers can decide for themselves what type of internal reporting system they will establish (e.g. postal route, complaint boxes, online – intranet or internet – platforms, telephone hotline, etc.) In all cases, the identity of the reporting persons must be treated confidentially.

Acknowledgement of receipt of the report to the reporting person must be sent and the notification must be investigated within 30 days at the latest The reporting person must be followed-up during the investigation of the report.

In some cases, the investigation of the report can be omitted, e.g. if the reporting was made anonymously, it was made by a person not entitled to do so, or in case a repeated report was made the same reporting person. 

If the initiation of criminal proceedings is justified based on the report, measures must be taken to file the criminal report, so this means a police reporting obligation. If the behavior described in the report is not a crime, but violates the employer’s internal rules, then employer action can be taken against the employee.

The reporting person must be informed of the results of the investigation and the measures taken.

3. Confidentiality of the reporting 

The internal reporting system must be designed in such a way that the personal data of the reporting person is kept confidential except by the person investigating the report. Until the conclusion of the investigation or the initiation of prosecution, information about the content of the report and the person involved in the report must be kept confidential and may not be shared with any other organizational unit or any employee of the employer.

At the start of the investigation, the person affected by the report must be informed in detail about the report, about his rights, and he must be ensured that he can express his opinion.

If the employer or its shareholder establishes internal rules of conduct (e.g. code of ethics, code of conduct), violations of these can also be reported in the internal reporting system.

Compliance with the new rules is supervised by the labor authority, however, the authority may not impose a fine on the employer or suspend its activity, however, other sanctions may be applied, e.g., statement of the infringement or obligation to terminate the infringement.

4. The protection of the reporting person

As a general rule, the Whistleblower Protection Act states that any measure that is detrimental to the reporting person, which is taken as a result of filing a report and is implemented in connection with the employment, is considered illegal even if it would otherwise be legal. In such a legal dispute, until proven otherwise, it has to be assumed, that the adverse action was taken due to the lawful filing of the report. Especially the followings are considered as such adverse measures: termination, transfer of job duties, change of place of work, reduction of salary, change of working hours, refusal of training, negative performance evaluation, failure to renew a fixed-term employment relationship or its early termination, damage to the person’s reputation, loss of business opportunity, requirement of medical condition, cancellation or early termination of the contract for goods or services. In other words, the legislation interprets as broadly as possible any adverse measure against the employee or subcontractor or contractual partner that was taken against him because of the report. This measure on the part of the employer is considered illegal even if the measure itself could otherwise be legal.

5. Summary

Summarizing the above, by December 17, 2023, employers with more than 50 employees must establish an internal abuse reporting system, with internal procedural rules, and this must be announced among employees. It is advisable to regulate how the report can be made, who investigates it within the company, how the protection of the reporting person is ensured during the procedure and how the investigation is carried out and completed