Practical issues of a whistleblowing system set up by an employer

From 24 July 2023, Act XXV of 2023 on Complaints, Public Interest Reports and Rules for Reporting Abuse (hereinafter: Complaints Act) entered into force in Hungary, which makes it mandatory for certain employers to establish and operate an internal whistleblowing system. For employers with a minimum of 50 employees and a maximum of 249 employees, the Complaints Act will enter into force on 17 December 2023, except for those employers who are subject to the obligation to establish an internal whistleblowing system regardless of the number of employees (see below under Who is required to establish and operate an internal whistleblowing reporting system?).

The old complaints act also contained provisions similar to the internal whistleblowing system for employers that has now come into force, under the heading “employer abuse reporting system”, but under the previous legislation, the internal whistleblowing system was always a voluntary option for employers, unlike the current one, which makes it mandatory for certain employers. Many large companies already operated an internal whistleblowing system under the mandate of the previous legislation, so this is nothing new for them, but the new provisions will also affect a number of companies that have not had to deal with this issue before.

According to the Complaints Act, neither a fine nor a ban on activities can be applied as a sanction for violations of the rules on the internal whistleblowing system established by the employer, but only a warning can be issued by the employment supervisory authority, which is not considered the most effective instrument against violations. Since the obligation to set up and operate an internal whistleblowing system is a cost for all the enterprises concerned, the small and medium-sized enterprises concerned will certainly benefit from not having to fear direct, more severe sanctions from the authorities if they fail to comply with this requirement. In the absence of serious sanctions, the first and most important question in practice is why should businesses subject to the Complaints Act comply with the requirements to set up an internal whistleblowing system?

The main argument for setting up an internal whistleblowing system is that it serves the legitimate and prudent operation of the business. As ensuring lawful and prudent operations is a positive asset for the company’s trading partners and creditors, including banks, it can help to increase the company’s business performance and value in the long run. For companies with a large number of employees, especially those owned by foreign investors, the operation of an internal whistleblowing system can be an additional tool for owners to ensure that they prevent or help detect corruption in the company that is damaging to the company. Another argument in favour of establishing a whistleblowing system is that abuses can amount to criminal offences, tax fraud, labour law violations or other legal harm that could give rise to civil litigation, so it is always to a company’s advantage to be aware of them as early as possible and to take steps to remedy them itself, as this will reduce the legal risks to its operations.

As the Complaints Act imposes a substantive legal obligation on certain employers to set up an internal whistleblowing system, the undertakings concerned must therefore be aware that failure to do so may constitute a breach of the law, preventing the persons authorised by the Complaints Act from reporting abuse of which they become aware to the whistleblowing system, which would result in a violation of the rights of the persons deprived of their right to report. In view of this violation of rights, the question may be raised as to whether an employer can be sued for failing to comply with the provisions of the Complaints Act by not allowing the reporting of abuse in accordance with the provisions of the Complaints Act? Theoretically, an infringement is established in such a case and therefore, in my view, a person who is restricted in reporting abuses may bring an action against the defaulting employer. The question is: what can be his claim in such a case? Should the court order the defaulting employer to set up a whistleblowing system and to receive the abuse of the aggrieved party? Could such a failure cause harm to a person restricted from reporting abuse, which he or she might be able to enforce against the defaulting employer in a damages action? Is a person whose right to report wrongdoing infringed only seeking a declaration of wrongdoing? On the basis of these questions, it is not clear that the harm suffered by a person whose right to report is limited as such as to make it worthwhile in practical terms to sue an employer, and it is therefore unlikely that many lawsuits would be brought for infringements in this area, especially as, in addition to the internal reporting of abuses, the person with the right to report may also be able to initiate other proceedings before a competent body (e.g. criminal proceedings, tax administration proceedings). If legal proceedings are nevertheless brought, the employers concerned should be aware that if they lose a case against them, they will have to pay the costs of the person bringing the action against them in addition to their own legal costs, and that if they fail to comply with this obligation in enforcement proceedings, the court may impose a fine of up to HUF 500,000 on them and their manager, which may be repeated.

In view of the above, it is recommended that all employers subject to the Complaints Act with regard to this obligation should take seriously their obligation to have an internal whistleblowing system. In order to facilitate understanding of the relevant provisions, the main issues relating to the establishment and operation of the whistleblowing system are examined and answered below.

Who should set up and operate an internal whistleblowing system?

Employers are the recipients of the obligation to report internal abuse, so it is important to understand who qualifies as an employer under the Complaints Act. An employer is defined by law as anyone who employs a natural person in the context of an employment relationship. And an employment relationship is any legal relationship in which the employee performs an activity for and under the direction of the employer for consideration or self-employment. On this basis, an employment relationship is also defined as an activity carried out for an enterprise by a natural person for remuneration in the context of an agency or business activity.

As a general rule, the obligation to set up an internal whistleblowing system is imposed on employers who employ at least 50 persons under an employment relationship. However, an internal whistleblowing system must be set up in the following cases, irrespective of the number of employees:

  • Employers subject to Article 1(1) and (1a) of Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing. This includes, among others, credit institutions, financial service providers, lawyers, law firms, auditors, accountants, tax advisors, real estate related activities and merchants who accept cash payments of HUF 3 million or more.
  • Employers registered in Hungary and carrying out offshore oil and gas activities outside the borders of the European Union as licensees or operators.
  • An employer subject to Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on civil aviation occurrence reporting, analysis and monitoring, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulation (EC) No 1321/2007 and Commission Regulation (EC) No 1330/2007.
  • The operator of Hungarian and non-Hungarian flagged floating installations in operation in the territory of Hungary.

Employers who employ up to 249 persons under an employment relationship may set up an internal whistleblowing system jointly or with another authorised employer.

The Complaints Act also allows for the establishment of an internal whistleblowing system for employers who are not subject to this legal obligation.

What is the purpose of the whistleblowing system?

The internal whistleblowing system allows you to report information about illegal or suspected illegal acts or omissions or other misconduct.

In addition to the above, if an employer imposes on its employees rules of conduct protecting the public interest or overriding private interests under conditions defined in accordance with the provisions of the Labour Code, violations of these rules may be reported through the internal whistleblowing system.

Who can report to the internal whistleblowing system?

In practice, anyone who has, has had or wishes to have some form of contractual relationship with the employer can make a declaration. The list of persons entitled to make a declaration is as follows:

  • The person employed by the employer.
  • An employed person whose employment relationship with the employer has been terminated.
  • A person who wishes to establish an employment relationship with the employer and for whom the procedure for the establishment of such a relationship has been started.
  • The self-employed person, the sole proprietor, the sole proprietorship, if he/she has a contractual relationship with the employer.
  • In respect of the employer, the person who holds an ownership share and the person who is a member of the administrative, management or supervisory body of the employer, including a non-executive member.
  • A contractor, subcontractor, supplier or person under the supervision and direction of a contractor, subcontractor, supplier or person under the supervision and direction of a trustee who has initiated a procedure for establishing a contractual relationship with the employer, or who is or has been in a contractual relationship with the employer.
  • Trainees and volunteers working for the employer.
  • A person who wishes to enter into a legal relationship or a contractual relationship with the employer as a self-employed person, sole proprietor, trainee, volunteer, and for whom the procedure for the establishment of such a legal relationship or contractual relationship has been initiated.
  • In relation to an employer, a person who holds an ownership interest and a member of the administrative, management or supervisory body of the employer, including a non-executive member, who wishes to establish a legal or contractual relationship with the consumer and for whom the procedure for the establishment of such a legal or contractual relationship has been initiated.
  • A person who has ceased to have a legal or contractual relationship with the employer as a self-employed person, sole proprietor, trainee, volunteer or as a self-employed person.
  • A person who has a share in the ownership of the employer and a member of the administrative, management or supervisory body of the employer, including a non-executive member, who has ceased to have such a legal or contractual relationship with the employer.

Who runs the internal whistleblowing system?

The internal whistleblowing system may, as a general rule, be operated by an impartial person or department within the employer designated for this purpose. The requirement of impartiality is difficult to interpret in practice, as the impartial person or unit designated by the employer is part of the employer’s organisation and is financially dependent on the employer, and thus on its management, but the purpose of the internal whistleblowing system is to provide a forum for natural persons who perform some form of work for the employer, to report to the employer any wrongdoing that they experience in the course of doing so, which potentially raises the possibility that the whistleblower may experience wrongdoing in relation to management or owners, which may make it difficult for the person operating the system to act impartially. To counter this situation, it is strongly recommended that internal rules governing the operation of the whistleblowing system within the employing organisation are developed, setting out the legal and other measures that guarantee the impartiality of the person or department operating the system.

In order to avoid the above conflict situation, the law allows the employer to contract a whistleblower protection lawyer or other external organisation to operate the internal whistleblowing system. A lawyer who carries out legal activities for the employer other than whistleblowing for the employer on a retainer basis, in an employment relationship, in another employment relationship with an employment obligation, or who has been in such a relationship in the five years preceding the conclusion of the contract of retainer for whistleblowing, cannot be a whistleblower protection lawyer for the employer. In this regard, a whistleblower protection lawyer independent of the employer should be engaged if this is the way in which the employer wishes to comply with the requirement to establish an internal whistleblowing system.

The Complaints Act also provides for the possibility for the employer to appoint another external body to operate an internal whistleblowing system instead of a whistleblower protection lawyer. In such a case, the external body will be subject to the conflict of interest rules applicable to the whistleblower protection lawyer and will also be required to be impartial.

How to report abuse?

The notifier may make the notification in writing or orally. An oral notification may be made by telephone or other voice messaging system or in person.

If a recorded telephone line or other recorded voice messaging system requiring the consent of the whistleblower is used as part of the internal whistleblowing system, the operator of the internal whistleblowing system shall make the oral report

(a) after having been informed in accordance with the provisions on the protection of personal data, record the information in a durable and retrievable form; or

(b) in writing and, subject to the possibility of verification, rectification and acceptance by signature, provide the whistleblower with a copy.

If the internal whistleblowing system does not use a recorded telephone line or other recorded voice messaging system, the operator of the internal whistleblowing system shall record the oral report in writing and provide the whistleblower with a copy, with the possibility to verify, correct and sign it.

If the whistleblower makes his/her report in person, the internal whistleblowing system operator will take the verbal report

(a) after having been informed in accordance with the provisions on the protection of personal data, record the information in a durable and retrievable form; or

(b) in writing and, subject to the possibility of verification, rectification and acceptance by signature, shall be given to the whistleblower in duplicate.

A full and accurate record of the verbal report must be made in writing by the operator of the internal whistleblowing system.

In the case of a verbal report, the whistleblower shall be made aware of the consequences of reporting in bad faith, the procedural rules governing the investigation of the report and that his or her identity, if he or she provides the information necessary to establish it, will be treated confidentially at all stages of the investigation.

Within seven days of receipt of a written report made through the internal whistleblowing system, the whistleblowing system operator shall send an acknowledgement of receipt to the whistleblower. The acknowledgement shall include general information to the whistleblower on the procedural and data management rules under the Complaints Act.

Regarding the written notification, the question is whether a notification made electronically, by e-mail, is considered as written? According to the court practice, a document with at least an enhanced security electronic signature – for example, using the AVDH service – is clearly a written declaration pursuant to Section 17 (1) of Act CCXXII of 2015 on the General Rules of Electronic Administration and Trust Services. The Civil Code. Pursuant to Article 6:7 (3) of the Civil Code, a legal declaration shall also be deemed to be in writing if it is communicated in a form that is suitable for the unchanged reproduction of the content of the declaration and for the identification of the declarant and the time of making the declaration. In my view, it may also be argued based on this provision of the Civil Code that the sending of a declaration signed and scanned by the declarant from the declarant’s e-mail address also constitutes a written declaration, although there is no clear case-law on this point. However, this issue is rather theoretical, since if an employer sets up an abuse reporting system, possibly accepting reports made by e-mail or other software solutions to facilitate the submission of abuse reports and investigates the substance of reports made in this way, this is a voluntary departure from the formal requirements by the employer which does not cause any legal harm to anyone. However, it is conceivable that a large company employer may wish to limit the number of abuse reports received and to exclude abuse of the whistleblowing system by adhering as strictly as possible to the formal requirements of the Complaints Act.

How are notifications investigated?

The operator of the internal whistleblowing system shall investigate the allegations contained in the report within the shortest time possible under the circumstances, but no later than 30 days from the receipt of the report. A whistleblower protection lawyer or other external organisation may be contracted to assist in the investigation of whistleblowing. Where an external body is engaged, the rules on conflict of interest applicable to the whistleblower protection lawyer and the rules on impartiality shall apply to the external body.

During the investigation of the whistleblowing report, the operator of the internal whistleblowing system shall maintain contact with the whistleblower, and may invite the whistleblower to complete or clarify the report, to clarify the facts and to provide additional information.

The investigation of the report may be waived if

(a) the notification was made by an unidentified notifier

b) the notification was not filed by a person entitled to do so under the Complaints Act,

c) the application is a repeat application by the same applicant with the same content as the previous application; or

(d) the harm to the public interest or to an overriding private interest would not be proportionate to the restriction of the rights of the natural or legal person (hereinafter together referred to as the “person concerned by the notification”) resulting from the investigation of the notification.

The investigation of the notification shall include an assessment of the relevance of the circumstances set out therein and, if necessary, the adoption of appropriate measures to remedy the abuse. If the report justifies the initiation of criminal proceedings, arrangements should be made to bring charges. The procedural issues and responsibilities for communicating the results of investigations to decision-makers should also be set out in an internal whistleblowing policy.

The operator of the internal whistleblowing system shall inform the whistleblower in writing of the investigation or non-investigation of the report and the reasons for the non-investigation, the outcome of the investigation of the report, and the action taken or planned. The written information may be waived if the person responsible for the internal whistleblowing system has orally informed the whistleblower of the investigation or non-investigation of the report and of the reasons for the non-investigation, the outcome of the investigation of the report, the action taken or envisaged, and the whistleblower has taken note of the information.

How can whistleblowers find the internal whistleblowing system?

In order to ensure that the abuse reporting system does not only formally exist within the employer, it is important that the abuse reporting system is easily accessible to whistleblowers. To this end, the Whistleblowing Act requires the operator of an internal whistleblowing system to provide clear and easily accessible information on the operation of the internal whistleblowing system, the procedure for reporting and the whistleblowing systems and procedures under the Act. In practice, the most practical solution is for the company to make information on the whistleblowing system available on its website.

What data protection provisions should be respected in relation to whistleblowing?

The internal abuse reporting system will create new data management activities and purposes for the employer operating it, therefore it is recommended to update and amend the record of data management activities and the relevant data management information notice before its operation. The Complaints Act also contains several provisions on data management, which should be taken into account by the operator of an abuse reporting system acting as a data controller.

The legislation provides that, within the framework of an internal whistleblowing system, personal data of the whistleblower, of the person whose conduct or omission gave rise to the whistleblowing and of the person who may have material information about the facts of the whistleblowing may be processed which are indispensable for the investigation of the whistleblowing. Such personal data may only be processed for the purposes of investigating the notification and remedying or stopping the conduct that is the subject of the notification and may only be transferred to the whistleblower lawyer or external body involved in the investigation of the notification. The whistleblower lawyer or external body acts in the capacity of a data processor in the investigation of the notification and therefore these agents must not only be contracted by the employer but also sign a data processing contract governing the relevant data processing activities.

From the data processed under the internal whistleblowing system, all personal data of the whistleblower, of the person whose conduct or omission gave rise to the whistleblowing and of the person who may have material information about the facts of the whistleblowing which are not indispensable for the investigation of the whistleblowing should be deleted without delay.

If the employer initiates legal proceedings on the basis of the notification, personal data processed under the internal whistleblowing system may be transferred only to the body competent to conduct the proceedings initiated on the basis of the notification, provided that this body is entitled to process the data by law or that the notifier has consented to the transfer of the data. The personal data of the notifier shall not be disclosed without his consent.

Where it has become apparent that the complainant or whistleblower has provided false data or information in bad faith and that there are indications that a criminal offence or irregularity has been committed, his or her personal data shall be transmitted to the body or person competent to conduct the proceedings. In the case of a false report made in bad faith, if there are reasonable grounds for believing that the report has caused unlawful damage or other harm to another person, the personal data of the person making the report shall be handed over to the body or person entitled to initiate or conduct the proceedings, at the latter’s request.

Where the notification concerns a natural person, in exercising his or her right of information and access under the provisions on the protection of personal data, the personal data of the notifier shall not be disclosed to the person requesting the information.

The transfer of data processed within the framework of the internal whistleblowing system to a third country or an international organisation may only take place if the recipient of the transfer has given a legal undertaking to comply with the rules on reporting laid down in this Act and in compliance with the provisions on the protection of personal data.

The above provisions should be included in the relevant privacy notice or it is recommended that the data management activities in relation to whistleblowing should be regulated in the internal policy on data management in the light of these provisions. An appropriate privacy notice is also particularly necessary because the person concerned by the notification, i.e. the notifier, the person whose conduct or omission gave rise to the notification and, finally, the person who may have material information about the facts of the notification, should be informed in detail about the notification, his or her rights regarding the protection of his or her personal data and the rules on the processing of his or her data at the start of the investigation.

What provisions protect the persons concerned by the notification?

The internal whistleblowing system must be designed in such a way that the personal data of the whistleblower who discloses his or her identity and of the person concerned cannot be disclosed to anyone other than the authorised persons. The steps, responsibilities, deadlines, rules on access to the data contained in the whistleblowing report and the persons entitled to receive it should be set out in the internal whistleblowing policy. Pending the conclusion of the investigation or the initiation of formal prosecution as a result of the investigation, the persons investigating the report may, in addition to informing the person concerned, share information about the content of the report and the person concerned with other departments or staff of the employer to the extent strictly necessary for the conduct of the investigation.

In any case, the persons concerned by the report shall be informed of the report made in accordance with the provisions of the Complaints Act as set out in the internal whistleblowing policy and of the investigation initiated on the basis of the report. In accordance with the requirement of a fair hearing, it shall be ensured that the person concerned by the report can express his or her views on the report through his or her legal representative and that these views are supported by evidence. Exceptionally, and in duly justified cases, the person concerned may be informed at a later stage if immediate information would frustrate the investigation of the notification.

Within the category of persons concerned by a whistleblowing, there are specific provisions protecting whistleblowers who may also be concerned by a whistleblowing against a person who has a decision-making position vis-à-vis them by virtue of a contract or hierarchical position in the workplace. In this respect, the Complaints Act provides that any measure adversely affecting the whistleblower which is taken as a result of the lawful making of a whistleblowing report and which is taken in connection with the legal relationship or connection under which a person is entitled to report abuse in the internal system established for that purpose under the provisions of the Complaints Act, even if it would otherwise be lawful, is unlawful. An adverse action is an act or omission which is detrimental to the whistleblower, in particular:

(a) suspension, collective redundancy, dismissal or equivalent measures,

(b) demotion or refusal to promote,

(c) delegation of duties, change of place of work, reduction of pay, change of working hours,

d) refusal to provide training,

e) negative performance appraisal or job reference,

(f) the application of any adverse legal consequence under the law applicable to the employment relationship, in particular disciplinary measures, reprimands or financial penalties,

(g) coercion, intimidation, harassment or ostracism,

(h) discrimination, adverse or unfair treatment,

(i) failure to convert a fixed-term employment relationship into an employment relationship of indefinite duration, where the employee had a legitimate expectation that his employment relationship would be converted into an employment relationship of indefinite duration,

j) failure to renew or early termination of a fixed-term employment contract,

k) damage, which includes damage to the person’s reputation or financial loss, including loss of business opportunity and loss of income,

(l) an action as a result of which it may reasonably be concluded that the person concerned will not be able to establish in the future an employment relationship in the sector in which he or she is employed,

(m) the imposition of a medical fitness test,

(n) the early termination or cancellation of a contract for goods or services; and

(o) the withdrawal of an authorisation.

In administrative or judicial proceedings relating to an adverse action listed in the above paragraph, if the notifier proves that the notification was lawfully made, it shall be presumed that the adverse action was taken because the notification was lawfully made and the burden of proof shall be on the person who took the adverse action to prove that the adverse action was taken for a valid reason and not because the notification was lawfully made. In addition, any adverse action taken against an entity owned by the notifier or an entity having an employment relationship or other contractual relationship with the notifier, which is taken because the notification was lawfully made, is unlawful even if it would otherwise be lawful.

Where a disclosure is lawfully made, the whistleblower shall not be deemed to have breached any restriction on disclosure of a legally protected secret or any other legal restriction on disclosure of information and shall not be liable in respect of such disclosure if the whistleblower had reasonable grounds to believe that the disclosure was necessary to disclose the circumstances to which the disclosure relates. Where a notification has been lawfully made, the notifier shall not be liable for obtaining or having access to the information contained in the notification, unless the notifier has committed a criminal offence by obtaining or having access to the information. A whistleblower shall not be held liable for lawfully making a notification if the whistleblower had reasonable grounds to believe that the notification was necessary to disclose the circumstances to which the notification relates.

The notifier may rely on the above rules of protection in all administrative or judicial proceedings, subject to proof that the notification was lawfully made.

The State shall provide the whistleblower with the assistance provided for in Act LXXX of 2003 on Legal Assistance under the conditions set out therein. In doing so, the notifier shall be provided with information and advice on the procedures and remedies available to notifiers, the rules for the protection of notifiers under this Act, and the rights and obligations of notifiers under this Act.

The protection referred to above, with the exception of legal assistance from the State, shall not be available to the notifier if

(a) by his/her notification, he/she infringes the rules on the protection of classified information,

(b) fails to comply with the obligation of confidentiality laid down by law in relation to medical confidentiality and legal professional privilege when making the notification,

(c) in making the notification, fails to comply with the obligation of professional secrecy imposed on him by his profession as a member of a church or religious association performing religious rites,

(d) in making the declaration, he or she infringes the rules on the protection of secrets protected by law in connection with the judiciary,

(e) in making the report, infringes the rules on data processing under the rules of criminal procedure; or

(f) as a member of the law enforcement agencies, the Military National Security Service or the National Tax and Customs Administration, by making a report, he or she infringes the rules on the activities of those agencies laid down by law.

What are the most important things for affected employers to do under the new notification protection rules?

You should check whether you are covered by the Complaints Act and whether you need to set up an internal whistleblowing system. Some organisations already have an internal system for ethics or other whistleblowing, so these organisations will need to assess the extent to which their whistleblowing system as an employer is compliant with the new legislation.

If the employer needs to set up an internal whistleblowing system that complies with the provisions of the Complaints Act, it will need to decide whether to operate it internally or to appoint an external party, including a whistleblowing lawyer, to do so. Once this decision has been made, you should draw up an internal whistleblowing system policy in parallel with the establishment of the system, and any issues that arise during this process may also help to make the system a reality. This task will include the designation of the persons responsible for this task within the employer’s organisation, the physical implementation of the information and reporting contact points and, where appropriate, the training of the persons involved.

In any case, the establishment of a whistleblowing system will create a new data management activity for the employer as data controller, so the data management register, the relevant data management information or data management policy will need to be amended, and a data processing agreement will be required if an external organisation, whistleblower protection lawyer, is engaged.

16 November 2023.

Dr. Zoltán Puskás, attorney-at-law

Contact Form