Hungarian Implementation of the EU Whistleblowing Directive

For the most part, the Whistleblower Protection Act implements the directive’s provisions, but in some points, it deviates from or goes further than the EU outline.

Number of Employees or Area of Business

The Whistleblower Protection Act obliges employers with at least 50 employees to set up internal reporting channels. Based on the act, hired workers and contractors are also regarded as employees. Furthermore, companies in particular business areas must set up a hotline regardless of their number of employees. This includes credit institutions, financial services companies, auditors, bookkeepers, tax advisors, law firms, firms carrying out activities related to real estate transactions, and companies in the oil and gas sector.

Companies with 50-249 employees are permitted to share resources through a joint internal reporting hotline.

Whistleblowers and their Subjects

A whistleblowing report may be made, among others, by prospective, current, or former employees, volunteers at the company, or by contractors, subcontractors, or suppliers having a contractual relationship with the company. Businesses have no obligation to investigate anonymous tips.

The internal reporting channels must be available for any unlawful or allegedly unlawful activities or omissions. The reporting person must not suffer any adverse measures (such as termination of employment) due to their whistleblowing.

Organizational Requirements

An independent and competent person or department must operate the whistleblowing hotline. Outsourcing the internal whistleblowing channel to specialist protection attorneys or third-party organizations is permissible. However, the responsibility for operating the hotline always remains with the employer.

Requirements Regarding Reporting

The Whistleblower Protection Act contains several mandatory procedural requirements for operating internal reporting channels. Among other things, companies are obliged to offer the option of whistleblowing in writing or verbally, maintain the confidentiality of the whistleblower and the person affected by the whistleblowing, comply with documentation obligations, take follow-up measures (for example, conducting an internal investigation or forwarding the information to the authorities), and give feedback to whistleblowers on the outcome of the investigation. Furthermore, a policy on the operation of the internal reporting channel is to be prepared and communicated.

Data Protection Requirements

Operating internal reporting involves processing the personal data of both the reporting person and the person affected by the whistleblowing. The company operating the internal channel must, as a data controller, prepare and communicate a privacy notice on the data processing. This must also be included in the company’s register of data processing activities.

The Whistleblower Protection Act strictly limits the recipients to whom the personal data can be transferred and the deletion obligations of the controller. Special rules apply to the transfer of personal data to non-EU countries.

Effect of the Act

The Whistleblower Protection Act enters into force 60 days after its publication (which has not yet occurred). At the moment, we envisage that the systems will have to be in operation as of the end of July 2023.

The act contains a grace period for companies with 50-249 employees, which are obliged to operate the internal reporting channel based on the number of their employees and not on their particular activities. The obligation to establish a reporting channel would only apply to them from December 17, 2023.

This article was first published in the Budapest Business Journal print issue of June 2, 2023.