In recent years, “inner abuse-announcement” (or whistleblowing) procedures have become more and more widespread within multinational companies. A new law, Act CLXV of 2013 on Complains and Notices of Public Concerns, acknowledges the importance of these procedures and has introduced regulations about employers’ use of abuse notification systems. The regulations also contain terms and conditions for managing employees’ personal data in this context.

According to the new regulations, the employer (or its parent company) can determine, taking into account relevant labour law, what rules apply to employees who blow the whistle. These rules and any whistleblowing procedure must be made public.

The employer may establish a procedure which reports employee whistleblowing in which the employee’s personal data is managed and may even be forwarded to a third party organization which is involved in any subsequent investigation. However, no sensitive data can be managed and the data management must be reported to relevant authority.

The employer must publish detailed information about its procedures and notification rules on its website in Hungarian.

Only employees can make a disclosure, namely those who have a contractual relationship with the employer. The employee must also have an interest in making the disclosure and in remedying the behaviour which has been disclosed. The employee who makes the disclosure must do so in good faith.

When a disclosure has been made, the employer is required to investigate it. Information on the investigation and notification, and on any measures which are being taken, must be made available to the employee. No investigation is required if a disclosure has already been made by the same person with the same content or about the same issues; the disclosure was made more than 6 months after the activity or default; or was made anonymously.

An employer may assign an announcement protection (whistleblowing) attorney for the purposes of receiving or investigating disclosures.

The employer must conduct an investigation within 30 days of the disclosure. The investigation period can, provided the discloser is informed, be extended up to a maximum of 3 months.

If, following the investigation, criminal proceedings are initiated, then a report must be filed. If the behaviour disclosed is not a criminal offence, but breaches the employer’s rules and procedures, the employer may invoke its own measures, according to the applicable labour law rules.