From 24 July 2023, Act XXV of 2023 on Complaints, Public Interest Reports and Rules for Reporting Abuse (the "Complaints Act") entered into force in Hungary, making it mandatory for certain employers to establish and operate an internal whistleblowing system. For employers with a minimum of 50 and a maximum of 249 employees, the Complaints Act applies from 17 December 2023, except for those employers subject to the obligation regardless of headcount.
The old complaints act contained similar provisions under the heading "employer abuse reporting system", but such a system was voluntary. Many large companies already operate one, but the new provisions also affect many businesses that have not previously had to deal with this issue.
The Complaints Act does not provide for fines or bans on activities; the employment supervisory authority can only issue a warning. Nonetheless, the obligation should be taken seriously: operating an internal whistleblowing system supports lawful and prudent business conduct — valued by trading partners and creditors — and helps large companies prevent or detect corruption and identify unlawful conduct (criminal offences, tax fraud, labour-law violations) early.
Because the Complaints Act imposes a substantive legal obligation, an employer's failure could arguably infringe the rights of those authorised to report. Practical enforcement is doubtful, but non-compliant employers may bear costs of unsuccessful litigation and, in enforcement proceedings, a fine of up to HUF 500,000 on the employer and its manager, which may be repeated.
Who should set up and operate an internal whistleblowing system?
The obligation targets employers. An "employer" is anyone who employs a natural person in an employment relationship, which includes activity performed for and under the direction of the employer for consideration (including agency or business-type activities). As a general rule the obligation applies to employers with at least 50 employees, but the following are covered regardless of headcount:
- Employers subject to Article 1(1) and (1a) of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (credit institutions, financial service providers, lawyers and law firms, auditors, accountants, tax advisors, real-estate professionals, and merchants accepting cash payments of HUF 3 million or more).
- Employers registered in Hungary and carrying out offshore oil and gas activities outside the EU as licensees or operators.
- Employers subject to Regulation (EU) No 376/2014 on civil aviation occurrence reporting.
- Operators of Hungarian and non-Hungarian flagged floating installations in operation in Hungary.
Employers with up to 249 employees may set up the system jointly or share one with another authorised employer. The Complaints Act also permits voluntary establishment of an internal whistleblowing system.
What is the purpose of the whistleblowing system?
The internal system allows reporting of information about illegal or suspected illegal acts or omissions or other misconduct. If the employer adopts, in accordance with the Labour Code, rules of conduct protecting the public interest or overriding private interests, violations of those rules may also be reported through the system.
Who can report through the internal whistleblowing system?
In practice, anyone with a past, current or prospective contractual relationship with the employer may report — current and former employees; job applicants where the recruitment process has started; contracted sole proprietors and single-member companies; owners and members of management, executive and supervisory bodies (including non-executive members); contractors, subcontractors, suppliers and persons under their supervision; trainees and volunteers; and persons in analogous prospective or terminated relationships.
Who runs the internal whistleblowing system?
The system may, as a general rule, be operated by an impartial person or department designated within the employer. Because that person is part of and financially dependent on the employer's organisation, internal rules should set out legal and organisational safeguards for impartiality. Alternatively, the employer may contract a whistleblower protection lawyer or another external organisation. A lawyer who has performed other legal work for the employer in a mandate, employment or similar relationship within the preceding five years may not act as its whistleblower protection lawyer.
How can reports be made?
Reports may be made in writing or orally (by telephone, other voice-messaging system, or in person). If a recorded telephone line requiring the whistleblower's consent is used, the operator must — after the required data protection information — either record the report in a durable and retrievable form, or set it out in writing and provide the whistleblower with a copy for verification, correction and signature. Where no recording is used, the oral report must be written up. The operator prepares a full and accurate written record and informs the whistleblower of the consequences of bad-faith reporting, procedural rules for the investigation, and confidentiality of identity throughout the investigation.
The operator must send a written acknowledgement within seven days of receiving a written report, together with general information on the procedural and data-processing rules. Whether an email report qualifies as "written" is nuanced: a document with at least an enhanced-security electronic signature (e.g. via the AVDH service) clearly qualifies, and under Article 6:7(3) of the Civil Code a signed and scanned document sent from the whistleblower's email address may also qualify — but case-law is not yet settled. If the employer accepts email or software-based reports and investigates them substantively, this is a permitted voluntary departure that harms no one.
How are reports investigated?
The operator investigates as quickly as circumstances allow, but no later than 30 days after receipt. A whistleblower protection lawyer or another external organisation may assist; the conflict-of-interest and impartiality rules that apply to whistleblower protection lawyers apply equally to such external bodies. During the investigation the operator maintains contact with the whistleblower and may invite them to complete or clarify the report.
The investigation may be waived if:
- 01the notification was made by an unidentified notifier;
- 02the notification was not filed by a person entitled to do so under the Complaints Act;
- 03the notification is a repeat report by the same person with the same content; or
- 04the harm to the public interest or overriding private interest would not be proportionate to the restriction of the rights of the natural or legal person concerned that would result from the investigation.
The investigation assesses the relevance of the reported circumstances and, if necessary, adopts remedial measures; if criminal proceedings are warranted, the operator arranges for a report. Escalation to decision-makers should be governed by the internal whistleblowing policy. The operator informs the whistleblower in writing (or orally, if orally briefed and acknowledged) of the outcome or waiver of the investigation and the measures taken or planned.
How can whistleblowers find the system?
The operator must provide clear and easily accessible information about the system's operation, the procedure for reporting, and the whistleblowing systems and procedures under the Act. The most practical solution is to publish this information on the employer's website.
Data protection considerations
The system creates new data-processing activities and purposes for the employer as data controller. Before it goes live, the record of processing activities and the applicable privacy notice should be updated. Only personal data indispensable for investigating the report may be processed; such data may be used solely to investigate the report and to remedy or stop the conduct at issue, and may only be shared with the whistleblower protection lawyer or external body involved. Those agents act as data processors and require a data-processing agreement in addition to their mandate. Personal data not indispensable to the investigation must be deleted without delay.
If the employer initiates legal proceedings on the basis of the notification, personal data may only be transferred to the body competent to conduct the proceedings, provided that body is legally entitled to process the data or the whistleblower has consented. The whistleblower's personal data may not be disclosed without consent. Where a report is false and made in bad faith and there are indications of a criminal offence or irregularity, the personal data must be transmitted to the competent body. Transfers to third countries or international organisations require legal undertakings on compliance with the reporting rules and personal-data protection.
Protection of persons concerned by the notification
The system must ensure that the personal data of the whistleblower who discloses their identity and of the person concerned cannot be accessed by anyone other than authorised persons. Investigators may share information with other departments of the employer only to the extent strictly necessary. Persons concerned must be informed of the report and the investigation and, in line with the requirement of a fair hearing, must be able to express their views on the report — including through legal representation — and support them with evidence. Exceptionally, information may be provided later where immediate information would frustrate the investigation.
The Complaints Act treats as unlawful — even if otherwise lawful — any adverse measure taken against a whistleblower because of a lawful report, including:
- suspension, collective redundancy, dismissal or equivalent measures;
- demotion or refusal to promote;
- reassignment of duties, change of workplace, reduction of pay, change of working hours;
- refusal to provide training;
- negative performance appraisal or job reference;
- adverse legal consequences under the employment relationship, in particular disciplinary measures, reprimands or financial penalties;
- coercion, intimidation, harassment or ostracism;
- discrimination, adverse or unfair treatment;
- failure to convert a fixed-term employment relationship into an indefinite one where such conversion was a legitimate expectation;
- failure to renew, or early termination of, a fixed-term employment contract;
- damage — including reputational harm and financial loss (including loss of business opportunity and income);
- measures that make it reasonable to expect the person cannot establish a future employment relationship in the sector;
- imposition of a medical fitness test;
- early termination or cancellation of a contract for goods or services;
- withdrawal of an authorisation.
In proceedings concerning such adverse measures, once the whistleblower proves the lawfulness of the report there is a presumption that the adverse measure was taken because of it; the burden then shifts to the person who took the measure. Adverse measures against entities owned by, or in an employment or other contractual relationship with, the whistleblower are equally unlawful. Lawful whistleblowers are not liable for breaching statutory secrecy or other disclosure restrictions if they reasonably believed the disclosure necessary, and are not liable for obtaining or accessing the information contained in the report unless doing so involved a criminal offence.
The State provides legal aid to whistleblowers under Act LXXX of 2003 on Legal Assistance. The above protection — except State legal aid — is not available where the whistleblower breaches rules on classified information, medical or legal-professional secrecy, secrets connected with judicial proceedings, criminal-procedure data-processing rules, or rules applicable to law-enforcement, military national-security or tax-and-customs personnel.
Key steps for affected employers
Determine whether you fall within the scope of the Complaints Act and whether you must establish an internal whistleblowing system. Where an ethics-reporting or similar internal system already exists, assess whether it complies with the new requirements. If a system is required, decide whether to run it in-house or engage an external party (in particular, a whistleblower protection lawyer). Alongside implementation, adopt an internal whistleblowing policy that addresses the practical questions arising from the roll-out — designation of responsible persons, information and reporting channels, and training. Because the system creates new data-processing activities, update the register of processing activities, the privacy notice and, where an external organisation or whistleblower protection lawyer is engaged, put in place a data-processing agreement.
16 November 2023 — Dr. Zoltán Puskás, lawyer