NEW WHISTLEBLOWER PROTECTION ACT IN HUNGARY

15 June 2023

The new Hungarian Whistleblower Act was finally adopted in May and will enter into force on 24 July 2023. It is particularly important, since businesses with more than 250 employees have to be compliant with the law before the above-mentioned date, while small businesses have deadline until 17 December 2023. In this article, we summarise the key tasks for employers under the new legislation.

1. Deadline to comply with the Act

The following undertakings have a 60-days deadline from 25 May 2023 to comply with the Act:

- businesses with more than 250 employees

- employers subject to the Money Laundering Act, such as tax advisors, accountants, lawyers, financial or head office service providers.

Businesses with a staff between 50 and 250 employees have a bit more time for the preparation, as they must comply by 17 December 2023 at the latest, with the concession that they may also set up a joint abuse reporting system.

2. Tasks - Internal abuse reporting system

The employer is required to set up an internal whistleblowing system (the rules on lodging and handling complaints) and appoint an impartial person responsible for the operation of the system by the above deadline.

There are no specific requirements for the system, so a separate email account or phone line could be appropriate.

The employer may choose to handle the reports received internally or may involve an impartial external person/organisation. Where appropriate, a so-called whistleblower protection lawyer may be contracted to carry out this task, but he or she must not have been employed or otherwise engaged by the undertaking for the last 5 years.

The key tasks of the acting trustee include

- informing the whistleblower about both the processing of his/her personal data and the procedural rules - with particular attention to safeguarding the security and integrity of the personal data processed throughout the procedure;

- where appropriate, ensure that a record of the oral report is drawn up, handed over to the whistleblower,

- conduct or assist in the investigation and

- liaise with the relevant departments and individuals.

3. Notification

In addition to employees, notifiers may also include (co-)owners, supervisory board members, trainees, and anyone who has ceased to have such a relationship with the employer or whose procedure to establish such a relationship is still in progress - therefore, anyone who has a contractual relationship with the undertaking or body concerned.

In the internal whistleblowing system, notifications may be made orally or in writing and shall be investigated as quickly as possible, but no later than 30 days from receipt of the notification, with an extension only in justified cases.

The complaints law allows for the reporting of virtually any illegal or suspected illegal act or omission, ranging from, for example, abuses in public procurement procedures, to breaches of professional secrecy, to consumer protection or environmental infringements.

The behaviours which may be reported include not only those that are illegal based on law, but also those that are defined as illegal in the employer's internal rules.

4. Procedure following a notification

On the basis of the notification, if it is substantiated, the employer has to take action,

- to restore the lawfulness or the public interest or to take any other necessary measures,

- to remedy the causes of the defects found,

- remedy the damage caused; and

- where appropriate, initiate proceedings for prosecution.

Where it has become apparent that the complainant or the person making a complaint in the public interest has supplied false information or data in bad faith, and

- there are indications that a criminal offence or irregularity has been committed, personal data shall be handed over to the body or person responsible for the procedure,

- there are reasonable grounds for believing that he or she has caused unlawful damage or other harm to another person, his or her personal data must be handed over to the body or person entitled to initiate or conduct the proceedings, at the latter's request.

In the coming month, employers should prepare to set up a complaints system for the handling of personal data related to the complaints, amend existing information notices accordingly and have a whistleblower protection officer in place to investigate the complaints received.