The Hungarian parliament has adopted a new law1 implementing the EU directive on the mandatory protection of (even anonymous) whistleblowers2 , which in many respects imposes stricter rules on companies and puts whistleblowers in a more favourable position. The new law, which repeals the previous rules on complaints and whistleblowing,3 poses significant challenges to most of the companies concerned; however, it is also in the interest of the companies to have an efficient whistleblowing system, as management may obtain information from whistleblowers and correct underlying problems that could result in serious sanctions for the company if detected by authorities, or the correction could serve to increase operational efficiency.

1. Scope of companies concerned

  • Under the new regime, companies with at least 50 employees are, as a general rule, required to set up an internal reporting channel. When considering the headcount threshold, not only direct employees but also other persons who perform work under a mandate or contractor arrangement should be taken into account.
  • Companies with less than 50 employees are not required to but may set up and operate an internal reporting channel to promote and maintain legal compliance.
  • As relief for employers with at a headcount between 50 and 249 employees, it is possible for them to set up and operate a joint internal reporting channel instead of a stand-alone system.

2. Internal reporting channels

The new law introduces a three-step system for reporting abuse, under which

  • the first step is an internal reporting channel, through which individuals can report within the company;
  • the second step is the so-called external channel, which concerns reporting to the competent authorities; and
  • as the third step, the individuals concerned may make their announcements public if specific conditions are met.

The internal reporting channel may be operated by a designated person or department of the employer and must be independent in this function, i.e., cannot be instructed by the employer. If a company does not wish to operate the reporting channel internally, it may appoint a whistleblowing attorney or another external organisation for such task.

3. Obligations of the companies concerned

The main tasks and obligations of the companies that are obliged to set up an internal reporting channel are to:

  • set up the channel and designate the person, department or external agent to operate it;
  • comply with strict data protection requirements when setting up and operating the channel;
  • inform employees about the channel's operation and data protection aspects, both before and after the channel is set up;
  • investigate all reports received within a tight deadline;
  • take the necessary measures to remedy misconducts following the investigation of the report;
  • ensure that the whistleblower will not be disadvantaged as a result of their lawful report.

4. What can be reported?

The internal reporting channel can be used to report information about unlawful or suspected unlawful acts or omissions, as well as other abuses. Accordingly, not only those acts, omissions or abuses that are under the scope of the specific subjects listed in the Directive can be reported, but technically any act, omission or misconduct that the whistleblower believes to be unlawful. It will also be possible for employees to report breaches of rules set out in certain employer policies to the internal reporting channel.

5. Who can report as a whistleblower?

The range of possible whistleblowers is rather wide, ensuring that not only employees of companies may report violations, but also anyone who has substantial information on possible violations and can help to detect them. Accordingly, reports may be made by the following persons of the companies concerned:

  • employees, including volunteers and trainees;
  • sole proprietorships and private entrepreneurs engaged by the company;
  • staff of contractors, subcontractors and suppliers engaged bv the company;
  • shareholders, managing directors or supervisory board members.

With regard to the above categories of personnel, it should be noted that not only persons who are currently occupying the above positions, but also those in relation to whom a recruitment or contracting procedure has started, or whose previous contractual relationship has ended with the company, are entitled to submit a report.

6. Deadlines

The deadline for employers to set up the internal reporting channel is 24 July 2023, i.e., the date of entry into force of the new law. As relief for employers with 50-249 employees, the deadline is 17 December 2023.

7. Authority inspection

The employment supervisory authority, i.e., the competent metropolitan and county government office, will monitor employers' compliance with their obligations regarding the internal reporting channel. With regard to adverse legal consequences, it is worth noting that, for the time being, the new legislation explicitly excludes the applicability of fines or prohibiting the performance of activities by the employment supervisory authority as sanctions.

8. How can Kinstellar help?

The new law aims to create an environment that promotes voluntary compliance by the companies concerned by providing greater protection and support to whistleblowers, which will impose significant tasks on the companies concerned, both in terms of the design of the framework as well as its operation. In this regard, Kinstellar can support companies in connection with the following tasks:

  • advising on the establishment of an internal reporting channel, preparing the necessary policies and procedures;
  • reviewing existing internal reporting channels at the local or group level to ensure compliance with the new law;
  • aligning companies' various internal policies and internal processes with the internal reporting system;
  • providing training and education to the management, persons or departments relevant to the internal reporting system, or to the entire workforce;
  • preparing notification documentation on the internal reporting channel;
  • carrying out independent investigations on submitted reports;
  • advising on the legal treatment of reported violations, utilising voluntary compliance, e.g., by voluntarily initiating legal proceedings;
  • providing ad hoc or on-going legal advice on legal issues arising in the operation of the internal reporting channel;
  • settling and regulating data protection issues related to the internal reporting channel, drafting the relevant documents.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.