The European Union’s authorities are even more vigorous than before in requiring Member States to detect and act effectively against breaches of EU law. This is also the aim of the new Hungarian act adopted on 23 May 2023 which obliges companies employing more than 250 employees to set up and operate whistleblowing systems amongst certain private and public sector actors from 24 July 2023 and for smaller companies from 17 December 2023.
As we wrote about in our previous article, the above objective resulted in the adoption of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of individuals who report breaches of EU Law (hereinafter: Directive), colloquially known as the “Whistleblowing Directive”, more than three years ago. The Directive had to be transposed into national law by each EU Member State in such a way as to cover both public and private sector entities, which must ensure that they have an internal whistleblowing channel and that whistleblowers are followed up. Unfortunately, progress in implementing the Directive in some EU Member States has been very slow: the EU Whistleblowing Monitor website provides a snapshot of the current situation.
Less well known to the wider public is the fact that Act CLXV of 2013 on Complaints and Notifications of Public Interest has been in force in Hungary since 2013, which also regulated certain rules of the voluntary employer abuse reporting systems, in addition to the complaints and notifications of public interest that can be submitted to the state and local governments.
This law will be replaced, once it enters into force, by Act XXV of 2023 on Complaints, Notifications of Public Interest and Rules for Reporting Abuse, recently adopted by the Hungarian Parliament. Also known in the press as the “Complaints Act” or the “Whistleblowing Protection Act”, published in the Hungarian Official Gazette, aims to comply with the Directive.
The new act will enter into force on 24 July 2023. It is very important that the abuse reporting system must be in place by the time the law enters into force in case of companies employing more than 250 employees and in sectors where such a system is mandatory regardless of the number of employees (see below). For companies employing 50 to 250 employees the deadline for compliance is 17 December 2023, giving the employers concerned a relatively short period of time to prepare and set up the system.
Under the Directive it is preferable that specific sectorial rules on protection of whistleblowers having been already adopted shall continuously apply as a matter of priority.
Therefore, the provisions of the chapter of the new act on the reporting of abuses shall only apply if the legislation listed in Annex 1 of the act issued for the implementation of, or in compliance with a legal act of the EU, or the binding legal act of the EU with general effect and direct applicability does not provide for different rules on the reporting of certain abuses and infringements and the protection of whistleblowers.
But who shall set up a whistleblowing system under the new law?
Unlike before, the new act’s rules on whistleblowing schemes shall apply to private sector employers and also to public sector employers including public and local government bodies, and are now mandatory rather than voluntary.
Generally, employers with at least 50 employees must establish an internal whistleblowing system in place. The number should be calculated based on the employees being employed in all kind of work relationships, not just in employment relationship with the employer. A work relationship is any legal relationship in which the worker carries out an activity for and under the direction of the employer for remuneration or for self-employment. This may include, for example, an assignment agreement or work contract as well, which are common forms of employment, so the 50-employee threshold is easily reached.
Employers who employ at least 50 and up to 249 people under a work relationship may set up an internal abuse reporting system jointly. This is expected to be easier for groups of companies, so that each company does not have to set up a separate whistleblowing protection system.
An internal abuse-reporting system should be set up for certain types of businesses, regardless of the number of employees. These include very exotic-sounding businesses, such as a domestically registered employer engaged in offshore oil and gas activities outside the EU, or even an operator of an operational floating installation. More importantly, all service providers as defined in the Hungarian Act on the Prevention and Repression of Money Laundering and Terrorist Financing, such as credit institutions, real estate agents, lawyers, accountancy firms, but also service providers dealing in or brokering cultural goods (works of art, antiquities) will be obliged to set up and operate an internal abuse reporting system.
The internal whistleblowing system may be operated by a person or department designated for that purpose who cannot be instructed in that function, or it may be operated by a whistleblower protection lawyer or another external organisation.
What is the system for and who can report abuse?
The internal whistleblowing system allows you to report information about illegal or suspected illegal acts or omissions, or other forms of abuse.
In the internal whistleblowing system a report can be made practically by anyone who is in any way connected with the company concerned, in particular: employees, contractors, subcontractors, suppliers, persons with an ownership interest in the employer, and persons belonging to the employer’s management, executive or supervisory body.
How to assure reporting?
The system must be designed to allow the whistleblower to make the notification in writing or orally (by telephone or other voice messaging system, or in person). Notifications should be investigated within a maximum of thirty days from the date of receipt of the notification, or within a maximum of three months if an extension is justified.
The internal whistleblowing system at the state and the local governments
In case of a state body, a municipality, a budgetary body under the management or supervision of a state body or a municipality, or an organisation or company owned or controlled by the state or a municipality, the rules are partly different and will be dealt with in a later article.
The role of the whistleblower attorney
A separate chapter of the act deals with one of the possible trustees of the whistleblowing system, i.e. the whistleblower attorney. The whistleblower attorney receives the notifications relating to the activities of the principal, provides legal advice to the whistleblower on how to make a notification, and liaises with the whistleblower.
The whistleblower attorney may, if necessary, request information and clarification from the whistleblower in order to investigate the notification, may assist the notifying party in the conduct of an investigation initiated on the basis of the notification, as the principal may direct, and shall, upon request, inform the whistleblower in writing of the events relating to the notification, in particular the outcome of the investigation initiated on the basis of the notification, the action taken by the principal or the refusal to conduct an investigation.
The whistleblower attorney shall transmit the notification to the principal but shall send to the principal an extract of the notification containing no personal data that would allow the identification of the whistleblower, unless the whistleblower has given his prior written consent to the transmission of his/her personal data.
The conflict of interests, i.e. the independence of the whistleblower attorney is guaranteed by the fact that he/she may not have any other contractual or employment relationship with the client who instructs the whistleblower attorney, and may not seek or accept remuneration or other benefits from anyone other than the client in respect of his activities.
The whistleblower attorney will also be trusted in the future to operate the internal whistleblowing system set up by private sector employers and to assist in the investigation of whistleblowing. This will alleviate the burden on employers who are obliged to set up an abuse reporting system, as they will not have to ensure the operation of the abuse reporting system within their own organisation and staff.
What safeguards protect whistleblowers?
The law provides strict protection for whistleblowers, beyond the obligation of confidentiality concerning their identity. For example, any measure which is detrimental to the whistleblower and which is taken because the whistleblower has made a lawful notification will be considered unlawful, even if it would otherwise be lawful. In addition, during administrative or judicial proceedings relating to such an adverse action if the whistleblower proves that the notification was lawful, the adverse action must be presumed to have been taken due to the lawful notification. In this case the burden of proof is on the employer who took the adverse action to prove that the adverse action was taken for a valid reason and not because the notification was lawful.
Where a report is lawfully made, the notifier shall not be considered to have breached the various legal provisions on confidentiality and shall not be liable in respect of such notification if the notifier had reasonable grounds to believe that the notification was necessary to disclose for the investigation of the circumstances to which it relates.
If a notification is lawfully made, the notifier shall not be liable for obtaining or having access to the information contained in the report unless the notifier has committed a criminal offence by obtaining or having access to the information.
A whistleblower shall not be liable for lawfully making a notification if the whistleblower had reasonable grounds to believe that the notification was necessary to disclose the circumstances to which the notification relates.
The above complex rules make it easy to see that it is therefore worthwhile to start preparing for the application of the new law in good time. If you have any questions about setting up a new system or acting as a whistleblower protection lawyer, please do not hesitate to contact us.
Telephone: +36 1 792 6744; +36 1 787 2136
E-mail: office@visegradlegal.hu