Hungarian Implementation of the EU Whistleblowing Directive
Dr. Edina Czeglédy, Counsel, Noerr and Partners Law Firm
On 23 May 2023, the Hungarian Parliament adopted its long-awaited Whistleblower Protection Act to implement the EU Whistleblowing Directive (EU 2019/1937). The directive aims to improve protection for whistleblowers across Europe by requiring companies to set up internal reporting channels.
For the most part, the Whistleblower Protection Act implements the directive’s provisions, but in some points, it deviates from or goes further than the EU outline.
Number of Employees or Area of Business
The Whistleblower Protection Act obliges employers with at least 50 employees to set up internal reporting channels. Based on the act, hired workers and contractors are also regarded as employees. Furthermore, companies in particular business areas must set up a hotline regardless of their number of employees. This includes credit institutions, financial services companies, auditors, bookkeepers, tax advisors, law firms, firms carrying out activities related to real estate transactions, and companies in the oil and gas sector.
Companies with 50-249 employees are permitted to share resources through a joint internal reporting hotline.
Whistleblowers and their Subjects
A whistleblowing report may be made, among others, by prospective, current, or former employees, volunteers at the company, or by contractors, subcontractors, or suppliers having a contractual relationship with the company. Businesses have no obligation to investigate anonymous tips.
The internal reporting channels must be available for any unlawful or allegedly unlawful activities or omissions. The reporting person must not suffer any adverse measures (such as termination of employment) due to their whistleblowing.
An independent and competent person or department must operate the whistleblowing hotline. Outsourcing the internal whistleblowing channel to specialist protection attorneys or third-party organizations is permissible. However, the responsibility for operating the hotline always remains with the employer.
Requirements Regarding Reporting
The Whistleblower Protection Act contains several mandatory procedural requirements for operating internal reporting channels. Among other things, companies are obliged to offer the option of whistleblowing in writing or verbally, maintain the confidentiality of the whistleblower and the person affected by the whistleblowing, comply with documentation obligations, take follow-up measures (for example, conducting an internal investigation or forwarding the information to the authorities), and give feedback to whistleblowers on the outcome of the investigation. Furthermore, a policy on the operation of the internal reporting channel is to be prepared and communicated.
Data Protection Requirements
Operating internal reporting involves processing the personal data of both the reporting person and the person affected by the whistleblowing. The company operating the internal channel must, as a data controller, prepare and communicate a privacy notice on the data processing. This must also be included in the company’s register of data processing activities.
The Whistleblower Protection Act strictly limits the recipients to whom the personal data can be transferred and the deletion obligations of the controller. Special rules apply to the transfer of personal data to non-EU countries.
Effect of the Act
The Whistleblower Protection Act enters into force 60 days after its publication (which has not yet occurred). At the moment, we envisage that the systems will have to be in operation as of the end of July 2023.
The act contains a grace period for companies with 50-249 employees, which are obliged to operate the internal reporting channel based on the number of their employees and not on their particular activities. The obligation to establish a reporting channel would only apply to them from December 17, 2023.
This article was first published in the Budapest Business Journal print issue of June 2, 2023.
SUPPORT THE BUDAPEST BUSINESS JOURNAL
Producing journalism that is worthy of the name is a costly business. For 27 years, the publishers, editors and reporters of the Budapest Business Journal have striven to bring you business news that works, information that you can trust, that is factual, accurate and presented without fear or favor.
Newspaper organizations across the globe have struggled to find a business model that allows them to continue to excel, without compromising their ability to perform. Most recently, some have experimented with the idea of involving their most important stakeholders, their readers.
We would like to offer that same opportunity to our readers. We would like to invite you to help us deliver the quality business journalism you require. Hit our Support the BBJ button and you can choose the how much and how often you send us your contributions.