Although the European Commission has suspended billions of Euros of EU funding due to the seriousness of corruption, strengthening whistleblower protection in Hungary did not become a remedial measure under the conditionality mechanism or a milestone in the Hungarian RRP, as it happened in some other member states. Yet there has been a need for a reform, as the Hungarian Whistleblower Act adopted in 2013 does not provide sufficient protection for whistleblowers, nor is it in line with the relevant EU directive. The Hungarian Government submitted a new bill on the protection of whistleblowers to the Parliament in February that aims to comply with the EU's directive. Although the Parliament adopted the bill, the President of the Republic did not sign it, criticizing its provisions on the protection of the Hungarian way of life. This blogpost assesses the content of the regulation.

In their joint analysis below, K-Monitor, Transparency International Hungary and  the Hungarian Civil Liberties Union (TASZ) have examined if the bill is able to provide sufficient protection for whistleblowers and whether it complies with the EU Directive. In short:

What can be reported?

It may seem like a small difference, but in the future it could have a real significance whether someone makes a public interest report or reports an abuse of EU law. The provision that a public interest report can be used to draw attention to a situation the remedying or removal of which is in the interest of the community or society as a whole is unchanged from the current legislation. This is therefore nothing new, unlike the Directive's requirement that only those who report a breach of EU law in the context of their profession are protected. The Directive, and the relevant chapter of the proposed law, which follows it, define in detail the areas in which the whistleblower who reports an abuse is protected. These include public procurements, money laundering, protection of the EU's financial interests and environmental damage, but also public health and food safety. This dichotomy creates serious uncertainties which could be avoided by simply granting all whistleblowers the higher level of protection laid down in the Directive, even if they do not make a report in relation to EU legislation but under the current domestic rules.

Who is protected?

Under the Directive, any whistleblower, whether working in the private or public sector, who becomes aware of information about an infringement in the context of their work and makes a complaint is protected. An employee in this case is broadly defined in the Directive, and can be, for example, a trainee, a volunteer, a consultant, a board member or subcontractor, a supplier, or even someone who is in the process of being recruited by a company or has already ceased to be employed. Importantly, the Directive also provides for the protection of helpers and third parties, so that family members and employees of the whistleblower (if they are contractors) are also protected if they are at risk of retaliation. In contrast, the current Hungarian legislation retained by the draft law, while not limited to employment-related reports, does not apply to family members and helpers at all.

How can a report be made?

Hungarian rules have so far offered two reporting channels for the public sector. The Complaints Act allows complaints to be made directly to the body concerned, which is defined by law as the body entitled to take action, or via the electronic interface operated by the Ombudsman's Office. The final addressee of the latter is also the body concerned. The Ombudsman advises the complainant and anonymises the complaint. However, the Ombudsman does not examine the content of the complaint and, even if it is rejected, can only check whether the rejection or the conduct and closure of the inquiry by the body entitled to act was formally correct. The Ombudsman is therefore in fact only acting as an intermediary ("postman") and the new rules will not change this.

However, a significant novelty is that the EU Directive distinguishes between three separate ways of making a complaint: an internal complaint (which can be made to the institution concerned), which exists in the Complaints Act, an external channel independent of the institution concerned (which will have to be operated by a designated public body) and, finally, under certain conditions, provides protection for those who choose to make their complaint in public. It is important that the whistleblowing system should be operated by a designated person or department within the employing institution who cannot be instructed in this function.In practice, this guarantee may prove to be insufficient, at least in the light of experience so far: integrity advisors, who have been operating for ten years now and are responsible (among other tasks) for preventing and managing corruption in public authorities, also cannot be instructed under the relevant legal provisions. In contrast, the wiretaps in the recent Völner-Schadl case, which have been made public through the press, show that the employees of the Ministry of Justice did not dare to report the former Secretary of State's known internal abuses to the integrity adviser of the Ministry, who was also reportedly involved in the case.

The internal whistleblowing channel

While the Complaints Act only provides for the possibility of setting up whistleblowing protection schemes in companies, the EU directive and the bill that follows it make this mandatory. So-called internal whistleblowing systems must be operated by all public and private institutions employing at least 50 people. This obligation applies not only to private companies, but also to public bodies, municipalities, various budgetary bodies and companies owned by the state or municipalities. However, there are exceptions.For example, organisations with fewer than 50 employees and municipalities with fewer than 10,000 inhabitants are not obliged to operate an internal reporting system, although it is not forbidden for them to do so either. Organisations with 249 employees or fewer are allowed to operate a reporting system jointly with other institutions. In contrast, the state’s principal authorities are obliged to establish and maintain an internal reporting channel, regardless of the number of employees.

For private sector operators, the Directive's provision that the internal whistleblowing system can be used not only to report abuses as defined in the legislation, but also to report conduct and omissions that violate company (internal) standards is important.

The external reporting channel

In addition to the internal whistleblowing channels, the Directive also requires Member States to designate an authority with adequate capacity to operate an external channel for receiving whistleblowing reports. Anyone, i.e. not only the person employed by the organisation operating the channel, can make a reports using such an external channel. The Bill meets this requirement in two ways. First, it requires ten principal authorities, each of which is in principle independent of the government, to establish a separate whistleblowing system, by designating them by name. These are:

1. Directorate General for Audit of European Funds (EUTAF)
2. Hungarian Competition Authority (GVH)
3. Integrity Authority (integritás Hatóság)
4. Public Procurement Authority of Hungary (Közbeszerzési Hatóság)
5. Hungarian Energy and Public Utility Regulatory Authority (MEKH)
6. Magyar Nemzeti Bank (MNB, The Central Bank of Hungary)
7. Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
8. National Media and Infocommunications Authority (NMHH)
9. Hungarian Atomic Energy Authority (OAH)
10. Supervisory Authority of Regulatory Affairs (SZTFH)

On the other hand, it authorises the Government to entrust an office under its subordination with the operation of a separate whistleblowing system. However, it is not yet known which government department will be given this task.

What happens with the report?

The Directive focuses essentially on the protection of whistleblowers, but does not address the guarantees for a meaningful investigation of the whistleblowing. Consequently, the proposal does not pay much attention to what actually happens with the complaint. It provides that the complaint must be examined within 30 days, with the possibility of an extension up to three months in exceptional cases. In addition, the content of the report must be checked and, if credible, appropriate measures must be taken to remedy the reported abuses, and a criminal complaint must be lodged if there is suspicion of crime.  These very general expectations are not likely to be effective, as the current rules leave no doubt that abuses brought to the attention of the competent authorities must be remedied.  Nor is there any reason to be overly optimistic about the fact that the draft law provides for the application of the provisions in force since 2014 on reports of public interest as a background rule, since this solution has not in practice guaranteed that the abuses reported will be remedied.

The Directive obviously sees the lack of sufficient evidence to initiate the necessary proceedings as the reason for the frequent failure to detect corrupt practices and other abuses in the majority of cases. In other words, it is not reluctance or bias on the part of the designated authorities, but a lack of information that is at the root of the failure. Indeed, if more and reliable information is needed, it is important that states, by creating (strengthening) protections, create conditions that encourage whistleblowing by mitigating the risks to the whistleblower. This explains the lack of Directive provisions on the investigation of whistleblower reports. However, it is fair to be concerned that in Hungary this alone will not lead to results.

The whistleblower protection lawyers

The draft law maintains the institution of the whistleblower protection lawyers , which has existed for nine years, but has so far proved attractive only to very few lawyers. Private sector entities will continue to be able to appoint whistleblower protection lawyers  to handle their whistleblowing. The bill additionally also allows for the outsourcing of whistleblower protection to other organisations, but does not provide any specific rules on this. The rules on whistleblower  protection lawyers  have been amended on a number of points, including strengthening the guarantees of independence of whistleblower  protection lawyers . It seems as such a guarantee that the whistleblower  protection lawyers  will no longer be able to accept other assignments or cases from the client and that his contract cannot be terminated or his fee refused on the grounds of his conduct. The whistleblower  protection lawyers  must preserve the anonymity of the whistleblower and therefore send an extract of the whistleblower's report to the client without any data that would allow the identification of the whistleblower. If the complaint concerns a senior executive of the client, the whistleblower  protection lawyers shall notify the supervisory board, auditor, the highest decision-making body of the client or the owner of the client.

 Public disclosure

One of the most important novelties of the Directive and, by implication, of the proposed law, is the extension of the protection afforded to whistleblowers to cases where they disclose the information to the public. A whistleblower who goes public will receive protection if they have first exhausted the institutional channels, i.e. if they have first made the disclosure to the organisation employing the whistleblower or to a public body operating an external channel, and the requested bodies have not taken action within the time limit set by law. A whistleblower may also bypass the institutional channels, but may only do so if they have reasonable grounds to believe that the circumstances they wish to report are manifestly prejudicial to the public interest, for example, because they threaten to cause irreparable harm. A whistleblower also has the right to go directly to the public if they have reasonable grounds to believe that they may be subject to retaliation due to the whistleblowing, or that their report will not be investigated.

The draft law, which transposes the Directive essentially verbatim, is flawed in the way it regulates the possibility to go public. Whereas, under the Directive, a whistleblower is entitled to make a public disclosure even if there is a mere 'risk' of retaliation, the Bill only allows this if there is a 'clear possibility' of retaliation. In other words, under the Bill, the threshold for the right of addressing the public is higher than that required by the Directive.

A further worrying limitation is that protection is not available to those who go to the press to make a disclosure. This restriction of rights is a consequence of the Directive, where a paragraph allowing for this possibility was inserted to give an exemption to Sweden, where constitutional protection strengthening freedom of expression is granted to anyone who goes to the public regardless of whether they make a public interest report. The Hungarian lawmaker was using this provision, either because of a lack of knowledge of the Directive or deliberately, to use the source protection in the media law to weaken the protection afforded by the Directive to those who go to the press. Source protection is the freedom of the journalist, a privilege enjoyed by the journalist and not by the person who provides the journalist with information. If the journalist does reveal the identity of his source or discloses relevant information to the authorities, for example, because a court orders it, the whistleblower is left entirely unprotected.

Anonymous reporting

The rules on whistleblowing make it possible to  reject  anonymous reports. An exception is if public interest reports indicate serious harm to rights or interests. These will have to be investigated even if the whistleblower cannot be identified. Unfortunately, there is no objective criterion for what constitutes a serious harm. The rules transposing the Directive will allow internal whistleblowing channels to reject anonymous reports. The draft law does not even give any guidance as to the cases in which the examination of a report may be waived. There is no specific provision at all for external whistleblowing channels, so the mandatory opt-out rule for whistleblowers will apply. However, it is important to note that for reports covered by the Directive, the law explicitly states that the anonymous reporting person will also be entitled to protection if they are subject to adverse action following identification.

 Statistics

While the Directive requires all bodies operating whistleblowing channels to keep a register of reports, the Bill only makes this mandatory for external whistleblowing channels, as well as the obligation to send annual statistics to the Ombudsman on the number of reports received and their treatment. It would be important that this is also done for the institutions operating internal channels and for whistleblower protection lawyers, as this is the only way to evaluate the effectiveness of the system.

What kind of protection can whistleblowers expect?

Under the Directive, whistleblowers who report information about an EU infringement covered by the Directive can expect protection.  As already mentioned, these include in particular public procurements, money laundering, protection of the EU's financial interests and environmental damage. Whistleblowers having reasonable grounds for believing that their whistleblowing concerns an EU infringement can also count on a higher level of protection under the Directive. A further requirement is good faith, i.e. that the report must be genuine in content or that the reporting person must have good reason to believe that they are raising a genuine issue.

Under the proposed law, a person who reports a non-EU infringement and has no reason to believe that their report is in any way covered by one of the ten pages of EU legislation listed in the Directive can rely only on the domestic whistleblower protection solutions currently in force.

 How are the two solutions similar and different?

One of the similarities between the two protection regimes under the proposed legislation is that both prohibit any adverse action against the reporting person for filing a report (the other similarity is the issue of grants to the reporting person, which will be discussed later).

In the context of EU reports, the Bill ensures that if, despite the prohibition, the reporting person would nevertheless suffer retaliation, the burden of proof would be shifted in the procedure initiated by the reporting person to remedy this. In other words, it is not for the whistleblower to prove that they lost their job because of their whistleblowing, but vice versa: the former employer must prove that they were not dismissed because of their whistleblowing. Furthermore, a whistleblower protected under EU law cannot be held liable for a breach of trade secrets and cannot be held liable for an infringement of the law for obtaining the information on which the whistleblowing was based.

In contrast, the old world non-harmonised practice of ten years,  which is ineffective in practice, remains the same, limited to the formal prohibition of retaliation. The whistleblower who finds themselves in this regime is forced to prove their claims themselves and even to expect that they will be prosecuted by the authorities for breach of confidentiality or other offences. This is what happened, for example, in the case of András Horváth, who was charged by the National Tax and Customs Administration (NAV) after he reported systemic VAT abuses publicly. But so happened to patent attorney György Pintz, against whom the Hungarian Chamber of Patent Attorneys launched disciplinary proceedings after he drew attention to an IT error that compromised patent secrets. Both of them had to endure a lengthy legal process to have it ruled that neither of them had abused their whistleblowing.

Unfortunately, this is where the Directive comes to a standstill in protecting whistleblowers. A whistleblower who discloses genuinely important secrets, such as classified information or information obtained in criminal proceedings, will not be protected, as neither are employees of investigative authorities and intelligence services, if they breach the rules governing the operation of their organisations by making a whistleblowing disclosure. A whistleblower who commits a criminal offence to obtain the information covered by the whistleblowing, for example by breaking the security code of a data storage system at work or stealing a document, might also be subject to the strict application of the law.

What support can the whistleblower expect?

Shifting the burden of proof and excluding liability for certain breaches of confidentiality is important, but the whistleblower can still get into serious trouble. In the unlikely event that the whistleblower is retaliated against despite the ban, the Directive, and the Bill that follows it, provides for support services under the legal aid rules. This is a kind of "people's lawyer" package, consisting of full information, legal assistance provided by the State for the preparation of various submissions and, if the whistleblower has to go to court, access to an advocate or defence lawyer. A whistleblower who, for example, loses their job or their contract as a contractor, or is sued for damages caused by the whistleblowing or, worse, is charged and ends up in the dock, will be provided with a lawyer by the state. This is not very much, as the State does not ensure that the whistleblower is defended by a designated authority and that the State pursues such actions on their behalf, nor is there such a requirement in the Directive. However, it is more than nothing, since the State at least does not leave the whistleblower completely on their own by providing the lawyer's expertise.

In practice, however, the costs of a legal adviser or a lawyer or advocate are not necessarily paid by the State. The benefit of legal aid is only available to the whistleblower in need, who does not really have to dig into their own pockets. Under the Legal Aid Act, which is the background to the Bill, a whistleblower is defined as in need if their monthly income does not exceed the "social projection base amount", which is HUF 28500 (~ €70) per month. Although there are many cases where a client with a monthly income above 28500 HUF is also considered needy, the point is that a whistleblower living on little more than absolute starvation cannot even expect the state to pay the cost of legal proceedings to remedy the illegal disadvantages suffered as a result of their whistleblowing.

Serious abuses can often be reported by people in senior positions or with significant contract power, and therefore typically higher incomes. However, they receive essentially no tangible support beyond a genuinely beneficial design of the rules of evidence and relief from the consequences of breaching confidentiality requirements, and thus continue to run a serious financial risk by reporting.

What is missing from the bill?

In addition to the Bill, the underlying Directive is also to blame for the shortcomings listed. However, the government could, if it wanted to, go beyond the Directive. Directives always contain only minimum standards, so it is true that the government can always impose additional protection for whistleblowersIn other words, it could, if it wished, allow for exemptions for the disclosure of serious secrets protected by criminal law and make it compulsory to investigate anonymous reports. And, of course, it could abolish the HUF 28,500 means-testing threshold and create quite a substantial arsenal to help whistleblowers. It could, for example, make it mandatory for the recently established Integrity Authority to ensure the protection of whistleblowers and to initiate and pursue, at its own expense, the necessary procedures to remedy unlawful retaliation against whistleblowers. Or, say, it could require the state to compensate the whistleblower for the damage they have suffered as a result of the already unlawful retaliation. Indeed, it could even be possible for the state to financially reward the whistleblowers whose whistleblowing has led to the discovery of serious abuses and, as a result, to the theft of substantial amounts of property or to the recovery of stolen property.

However, the Bill fails to do this, nor does it ensure that the newly introduced provisions will be enforced in practice by any public authority. Perhaps the biggest problem with the whistleblower protection scheme, which was created in 2013 and is adopted without changes by the Bill as a kind of domestic regime, is that the lack of controlsthat organisations that simply do not implement the provisions of the Complaints Act risk nothing. As has been pointed out, the Directive itself does not deal with what happens to the reports, but focuses instead on protecting the whistleblower. Perhaps the Directive is based on the premise that member states all have a functioning rule of law with public authorities that do their job and investigate the complaints that come to them. However, this is not the case in Hungary, as is most clearly demonstrated by the rule of law procedure launched by the European Commission last summer, in addition to many years of experience. In the absence of effective enforcement, the provisions of the transposed directive are unlikely to bring any breakthrough in the fight against corruption, but they may at least improve the protection of whistleblowers.

What’s next?

Despite objections and criticism, the Bill was passed by Parliament in April, but was not signed by President Katalin Novák, who instead sent it back to Parliament for consideration. According to President Novák, provisions serving to protect the Hungarian way of life and the values of the Fundamental Law is in fact "contrary to its title", and it is not clear exactly what conduct can be reported under the Bill. The President has asked the Parliament to re-adopt the Bill without the part she objects to, but the other shortcomings outlined above are still not expected to be satisfactorily addressed.

If you would contribute to the fight against corruption in Hungary,

Support K-Monitor with a gift!