As we reported earlier, under Act XXV of 2023 on Complaints, Public Interest Reports and Rules for Reporting Abuse (the Complaints Act), companies with 250 employees will have to set up an internal abuse reporting system from 24 July 2023, and employers with 50 or more employees will have to do so by 17 December 2023, which will affect a number of companies. When setting up and operating an complaint reporting system, there are some practical considerations to take into account, which are summarised below.

Calculation of the number of employees
The number of 50 persons is calculated not only on the basis of the number of persons employed, but also on the basis of the number of persons employed in all employment relationships. An employment relationship is any relationship in which the employee performs an activity for and under the direction of the employer for remuneration or self-employment. This includes, for example, employment on an agency or contract basis, which are common forms of employment, making the 50-employee limit much easier to achieve than many managers think. For the above reasons, it is worth checking, even with an expert, whether the company is obliged to set up and operate an internal complint reporting system.Setting objectives
An important aspect is to define the type of complaints the company wants to respond to. Abuse is defined as any unlawful or deemed unlawful act that is not necessarily an offence or a criminal offence, but which is legally or morally objectionable, for example, a breach of the company’s code of ethics. In addition to the use of trade secrets or confidential information, whether for personal or business purposes, misconduct includes, inter alia, the use of company assets for illicit private purposes, collusion with a business partner of the company, acceptance of gifts or other benefits from a client or partner above a certain value, as well as violations of equal treatment, repeated teasing, humiliation of colleagues or other violations of standards of conduct, such as approaching others in an inappropriate manner. In addition to legal compliance, the operation of an complaint reporting system is an important means of detecting and dealing with internal abuse, which often remains hidden for long periods, both to reduce the number of terminations and the need to take legal action, and to protect the company from financial and reputational damage.

Regulatory framework and expert involvement
An important step in setting up a system is to be familiar with relevant legislation and other regulations governing whistleblowing systems, which will ensure adequate legal protection and compliance. In order to ensure that the company’s specific objectives in this regard are met and legally compliant, it is worth engaging an expert with the right expertise and experience to assist not only in drafting and tailoring the necessary regulations, but also in setting up the system from the planning phase to the start of operations.

Determining the method of notification
Employers are free to decide on the specific method and type of whistleblowing, but this may depend on company preferences, the sector concerned and the knowledge and capabilities of the whistleblowers. A popular choice of offline, paper-based whistleblowing channels is the installation of a complaint box, where the whistleblower can place their complaint in a sealed envelope in a locked physical box or letterbox. In addition to physical reporting, online platforms such as web interfaces, special applications and electronic solutions (dedicated e-mail) are of course also popular, usually requiring IT development or the purchase of specific software. In addition, there are, of course, other, more traditional ways of doing things, such as notification by telephone or by post. However, before making a choice, it is worthwhile to examine the different notification methods and the possible procedures from the point of view of both the company and the person entitled to notify.

Aspects of the operation of the internal whistleblowing system
Persons entitled to report: it is important to stress that not only employees or former employees of the company may report, but also trainees, job seekers, volunteers, persons employed under a contract of employment, as well as business partners, suppliers, self-employed persons, and subcontractors of the company.
Investigation of reports, operation of the system: the operation of the system and the investigation of incoming reports may be entrusted to internal, trusted employees or teams (e.g. compliance, HR, legal), but the employer has no right to give instructions in relation to this activity. The above tasks can also be outsourced, for example by hiring a whistleblower protection lawyer. The pooling of resources also creates the possibility for companies in a group to operate their whistleblowing systems together by setting up so-called group-wide whistleblowing systems.

Data protection issues and related actions
The implementation of internal whistleblowing systems, in addition to its role in establishing an ethical corporate culture, can raise serious data protection issues. The principle of data minimisation under the GDPR requires that, also with regard to the whistleblower protection system, it should be ensured that only the data necessary for making and investigating a whistleblowing report is actually processed, with the scope of the necessary data varying at different stages of the investigation of the report. The lawfulness of data processing is ensured on the legal basis of the fulfilment of the legal obligation where the company is obliged to establish a whistleblowing system pursuant to Article 18(1) to (3) of the Complaints Act. For data protection compliance, data processing related to whistleblowing schemes should be updated in internal data protection records and data processing notices should be revised. In addition, if the operation of the system is outsourced, a data processor or joint data controller agreement is recommended.
Taking the above into account can help to build and operate an effective and transparent whistleblowing system that protects the interests of the owners in the long term.