Lessons learned: practical experience from Hungary’s whistleblowing law

Hungary is in a special position at the European level, as it has almost a decade of experience in the application of
whistleblowing systems and the protection of whistleblowers. In 2013, Hungary adopted the Act CLXV on complaints and public interest reporting (the “Act”).¹

Therefore, the required implementation of the provisions of the EU Whistleblowing Directive into Hungarian law by 17
December 2021 will obviously mean the comprehensive review of the whistleblower protection legislation on the basis of the Act currently in force.

EU Whistleblowing Directive goes further than current Hungarian legislation

The Act already regulates all important aspects of the Directive (i.e., receiving and investigating reports of wrongdoing,
protection against retaliation, registration of reports, and the power of investigation currently vested in the Hungarian
Commissioner for Fundamental Rights (the “Ombudsman”) as an external investigative tool). However, the Directive is much more detailed and specific than the Act. Therefore, a medium-scale amendment of the Act is expected in Hungary, involving several dozen provisions.

This is because the Directive sets much stricter minimum standards than the current Hungarian rules, in particular
as regards the reception, handling and processing of reports.

Due to the requirements of the Directive, mandatory whistleblowing systems will be much more widespread in the private sector after implementation. Under the current Act, such systems are optional, whereas under the Directive they will be mandatory for companies with more than fifty employees.

Ensuring confidentiality and protecting whistleblowers promotes trust in organisations

One might conclude that the current reporting options under the Act are adequate, as whistleblowers can already complain, for example by e-mail or telephone. However, this level of security does not meet the requirements of the new Directive.

Reporting from a private email address or by telephone involves revealing the identity or at least the risk of easily identifying the whistleblower. This can deter whistleblowers because of the often legitimate and well-founded fear of the consequences of being identified

However, operating a fully anonymous reporting platform builds trust between the whistleblower and the organisation, thereby increasing the number of reports. In the long term, this is the only way to ensure that an organisation can operate transparently and free from corrupt practices.

The implementation of the relevant system, therefore, requires careful planning and the establishment of
workplace channels that ensure the confidentiality of the identity of the whistleblower and the person
to whom he or she refers. It also requires that the whistleblower receives confirmation that the report has
been received. Lastly, feedback to the whistleblower should be provided within three months at the latest.

Therefore, under the existing Hungarian legislation, a mere hotline, an office mailbox, an online whistleblowing
system or a general e-mail account for receiving whistleblower reports without the abovementioned workplace channels and required planning is inadequate. This is why it is important for Hungary to update the rules of the Act pursuant to the Directive.

Allowing external lawyers to receive reports effectively maintains confidentiality Who should sit on the other side of the channel: the HR staff of the company in question, employees hired specifically for this job, or is it better to outsource it?

The Act already allows organisations to conclude contracts of engagement with lawyers to receive reports in the framework of the procedure for handling reports (a whistleblower protection lawyer). In this regard, the Hungarian approach is an effective means to maintain the confidentiality of the whistleblower via the lawyer, who can also provide the whistleblower with legally correct information about his/her possibilities and rights. In order to ensure a higher
level of transparency, whistleblower protection lawyers must comply with strict conflict of interest rules and
qualification requirements under the Act.

In addition, the whistleblowing system should be designed in such a way that the identity of the whistleblower cannot be known to anyone other than the investigators of the whistleblowing. The lawyer investigating the whistleblowing must keep the information about the persons concerned confidential and must not share it with any other department or employee of the client.

Hungarian legislation generally requires whistleblowers to identify themselves

The Directive left open the question of anonymous reporting. This is a matter for each Member State to decide in its own legislation. If countries allow anonymous reporting, it will be subject to specific rules. Under the current provisions of the Act, the notifier is required to provide his or her name and address, and to declare that he or she is making the notification in good faith of circumstances of which he or she has knowledge or reasonable grounds to believe that they are true. The employer has a duty to inform the whistleblower when making the report, as the whistleblower must be aware of the procedural rules governing the investigation of the report, the consequences of reporting in bad faith
and that his or her identity will be treated confidentially at all stages of the investigation.

The employer must investigate the report and inform the whistleblower of the outcome of the investigation and the action taken.

However, a very important provision of the Act is that if the whistleblower does not provide his or her name and address, the employer is allowed to refrain from investigating the complaint. This clearly does not serve the interests of whistleblowers who prefer anonymity.

Partial anonymity is possible through public interest reports to the Ombudsman

It is a further Hungarian peculiarity that the Ombudsman has also been given a role in the management of public
interest reports, as the central electronic system for filing and registering public interest reports is managed and operated by his/her office. The Ombudsman also has additional powers, for example to investigate the
practices of public bodies in handling reports of public interest.

The central electronic system ensures whistleblower protection (and anonymity) and related online services only for whistleblower reports handled electronically by identified whistleblowers for the Ombudsman’s Office. It is therefore possible to submit a complaint electronically and upload the related documents (evidence) through the interface provided on the Ombudsman’s website after identification.

The whistleblower is identified as follows: an information letter is sent to the whistleblower by return receipt, marked “to the addressee”, explaining the use of the electronic system and containing the token generated by the system for tracking the case. Receipt of this letter (as evidenced by the return of the signed return receipt), together with the token sent and the password provided by the client, will identify the first access to the system.

Paper-based reporting is not possible if anonymity is preferred in public interest reports

In all cases, the whistleblower must provide his/her name and address but may request anonymity in the
electronic procedure, i.e. that his/her personal data be accessible only to the Ombudsman’s Office. In this
case, the Ombudsman will make the report and its annexes, or an extract thereof without personal data,
available in the electronic system to the competent body responsible for examining it. It also follows,
however, that paper-based reporting is not possible under the Act, if anonymity is preferred.
The administrative body responsible for dealing with a public interest report will also be able to view the report
in relation to which it has a procedural obligation after it has been registered in the electronic system. In this
sense, the electronic system can be understood as an intermediary platform between the parties.
Evidence shows that whistleblowers prefer anonymity in Hungary and may not file without it Experience with operating the electronic system shows that the vast majority of thousands of complainants per year requested anonymity (i.e. that their personal data should be accessible only to the Ombudsman’s Office).

It is also noteworthy, however, that of those who were invited to use the electronic system (and thus to register) after requesting anonymity in a paper-based case, nearly one third preferred to forego the electronic report (and thus to have their case investigated).

Thus, a very significant proportion of notifiers would insist on maintaining their full anonymity even at this price, which is not fully guaranteed by the current rules of the Act. In any case, observers will be keen to see how Hungarian legislation will change in this respect following the amendments made to the Act pursuant to the Directive.

¹ Applicable since 1 January 2014