The Hungarian Whistleblower Protection Act has entered into force this July. While bigger companies have to operate the internal whistleblowing system since the above date, medium sized businesses (50-250 employees) were given a prolonged period until the 17th of December 2023 to implement the reporting channel. Since the deadline is approaching, we summarize how Hungarian SMEs can comply with the Act.
In general, companies or other legal entities employing at least 50 workers are obliged to establish channels and procedures for internal reporting and for follow-up.
The term “worker” used by the Act is a broader term than employee, as it also includes other legal relationships aimed at the employment of natural persons.
Entities with less than 50 workers may choose to voluntarily set up a reporting channel.
In case of certain activities stipulated in the Act, for example activities falling within the scope of the AML Act, the reporting channel shall be established regardless of the number of workers.
The operator of the reporting channel is obliged to investigate the reports and, if necessary, to take the appropriate measures, and to inform the reporting person about the report.
As a first step, the entity shall create a suitable reporting system, either by itself (e.g., an email address) or by entrusting an external service provider, who usually provides an online interface on a monthly fee basis.
Then, the legal entity must designate the person(s) or department who handle and investigate the reports, which can be either an internal person/department within the entity or an external agent independent of the entity.
The internal person must be impartial, the external agent must also comply with the conflict-of-interest rules defined in the Act.
To comply with the Act, the legal entity must establish an internal policy regarding the reporting channel, and employees must be informed about it. Since the operation of the reporting channel involves the management of personal data, the entity must ensure data protection compliance, including updating the relevant data protection documents.
To summarize the above, medium sized businesses (50+ workers) in Hungary have to establish internal reporting channel before 17 December 2023. It is advised to involve a legal expert in the process as most of the service providers who advertise online focus on the IT aspects of the reporting, which alone is not sufficient to comply with the Act.
By Peter Gritta, Attorney-at-law, SmartLegal Schmidt & Partners
