Bulgarian internal investigations regulated by collection of laws and best practices until passage of whistleblower act before end of 2021

Whistleblower series: Bulgaria

No single law governs how an internal corporate investigation of corruption or wrongdoing can be conducted in Bulgaria. Yet when faced with allegations of wrongdoing in its ranks, a Bulgarian-based company has options at its disposal through various regulations, some case-law and the best practices currently being employed.

What exactly are these options?

Stage one of the process is the report, originating from a whistleblower or through an internal audit, that a wrongdoing has taken place. In certain circumstances, Bulgarian law requires that a company take immediate action.

For example, according to Bulgaria's Protection Against Discrimination Act, if an employee is being harassed or bullied in the workplace, the company must implement measures immediately to stop this harassment and investigate the case.

This may entail separating the harassed employee from his alleged harasser. Or it could require that the suspect be put on leave while an investigation is conducted.

But it should be noted that suspending an employee from work can be problematic under Bulgarian law, which does not explicitly address this issue. By law, employees can only be suspended if they arrive at the workplace in a “state” that does not allow them to complete their duties (e.g. under the influence of drugs or alcohol). In this case, they are suspended as long as they are unable to work and during this period they are not paid.

Although “garden leave” — suspending an employee while an investigation is ongoing — is not recognised in Bulgaria, it is accepted by many foreign jurisdictions where Bulgarian multinational companies are based. Hence, a multinational may need to exercise "garden leave" if this is recognised in the country where the company is based and reflects in its internal policies.

But in this case, these employees must be paid while they are not in the office, mainly to protect the Bulgarian company from any future court action.

To avoid other legal risks, in cases of garden leave, companies must ensure that there are no personal items belonging to the suspended employee left in on the worksite. If this occurs, this could be interpreted as denying an employee access to private property and – crucially – personal data, if the property in question includes a laptop, tablet or storage drive.

In terms of the actual investigation, many companies have whistleblowing procedures in place that employees can use to report wrongdoing or harassment. But whether or not a company has internal policies in place to report grievances, a firm is still obliged to respond if wrongdoing is uncovered.

Clearly, procedures can vary from company to company, but can include the following processes: a careful collection of evidence through interviews, reviews of business emails and company messaging services, an inspection of company phone records and computer usage, inspections of CCTV video (if available) and physical searches of the working area.

Of these investigation techniques, interviews are the most common and effective. To hold interviews, companies usually create an interview commission, which should be made up of one or more senior managers, an HR official and a legal counsel. Depending on the alleged wrongdoings, it may be advisable to add the company compliance officer or the line manager.

The number of staff to be interviewed depends on the case. Minor offences may require the interview of only one person: namely, the accused. More serious offences, particularly those that could incur legal liability to the company, may require a more exhaustive round of interviews to bring all the facts to light.

When a suspect is being interviewed, he does not possess the right to have legal representation present, although a company — in the spirit of fairness and to protect itself from future court challenges — may allow it. Representative bodies, such as trade unions or works councils, need not be officially informed that the interviews will take place. But again, a company may choose to do so.

During interviews, minutes of the proceedings should be taken, either by a stenographer or a committee member. After each interview, these notes should be reviewed by commission members and the interviewees, and signed by all involved to certify their accuracy.

Interviewees may choose not to sit before a commission, but answer questions in writing. This is an acceptable practice and at times preferable, since written responses may be more revealing.

Once the interviews are completed, the commission should draft and release a report summarising the proceedings and analysing the evidence it collected.

In terms of email and text-messaging scans, any data searches of electronic devices and computers must comply with the EU’s GDPR, Bulgaria’s data protection law and Bulgarian and EU human rights legislation. In terms of GDPR compliance, companies should ensure its digital search procedures are completely transparent and focused only on data that is directly related to the investigation. Every effort should be made to protect the privacy of the data scanned and collected.

Bulgaria’s data protection act states that companies should have GDPR-compliant internal investigation procedures in place for data collection and that employees should be well aware of these processes. Furthermore, companies must establish clear guidelines regarding any private use of company email and messaging systems, which include the types of communications that may be monitored by the company.

In short, a balance must be struck: the company should establish policies that allow for an investigation of its communication systems, but also exhibit GDPR-compliant respect for personal privacy. A 2017 case adjudicated by the European Court of Human Rights explored the legal implications of data collection in the Romanian workplace. This decision can be studied in detail when drafting internal data-collection rules.

After an investigation is complete, it may be necessary to report findings to outside sources. Multinational companies may need to report these findings to law enforcement or judicial authorities in the countries where their head offices are located (e.g. the US Justice Department).

If the investigation proves that an employee was guilty of a disciplinary wrongdoing, it may want to hand down disciplinary sanctions, such as a reprimand, warning of dismissal or dismissal.

Whatever disciplinary penalty an employer issues, it must be handed down no more than two months after learning of the breach and no more than one year after the breach has been committed.

In addition, companies should then look at ways to prevent similar abuses from occurring in the future, and implement all necessary reforms. In cases of harassment and bullying, this could include adopting a code of conduct and staff training that counsels against such behaviour. Reforms could also include enhanced whistleblowing systems, employee communication channels, and in-house investigation procedures that can better identify wrongdoing and arrive at the facts faster.

Bulgaria’s legislative vacuum surrounding internal investigations will not last indefinitely. As a result of the 2019 EU Whistleblowing Directive, Bulgaria is required to adopt its own national whistleblowing legislation no later than December 2021. The EU’s interest in protecting whistleblowers is borne out by the economic costs of corruption, which – within the EU’s public procurement sector – results in losses of between EUR 5.8 billion and EUR 9.6 billion annually.

Bulgarian companies that are reviewing, revising or drafting whistleblowing and internal investigation procedures are encouraged to study this directive and insure that all their internal policies comply, since these regulations will soon be reflected in the law of the land.

For more information on internal investigations in Bulgaria and the upcoming whistleblower legislation, contact your regular CMS advisor or local CMS experts Iveta Manolova and Maria Harizanova.