Bulgaria has officially transposed the Whistleblowing Directive

Despite the political turmoil, Bulgaria has finally transposed Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the "Whistleblowing Directive") into its national legislation. After several draft laws, heated political debates, and a delay of more than a year, the Bulgarian Parliament adopted the Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act (the "Whistleblowing Act"). The Whistleblowing Act aims to protect persons in both the public and private sectors who report violations or disclose information concerning breaches of Bulgarian or EU legislation in the course of their occupational duties. The Whistleblowing Act was adopted on 2 February 2023 and will enter into force on 4 May 2023. A prolonged implementation period, until 17 December 2023, is envisaged for some of the private sector employers having between 50 and 249 employees.

Who is affected?

The requirements and obligations introduced by the new Whistleblowing Act concern:

1. Public sector employers, except for municipalities with a population of no more than 10,000 people or no more than 50 employees,
2. Private sector employers with 50 or more employees, and
3. Private sector employers, irrespective of the number of employees, if the scope of their activities is in financial services, money laundering and terrorism financing prevention, environment protection, etc.

Who is protected?

The Whistleblowing Act protects individuals ( “Whistleblowers”) who report or publicly disclose information about a violation. The disclosed information must be acquired through a work-related relationship, for example, in their capacity as an employee, public official, self-employed, consultant, volunteer, trainee, shareholder, board member, contractor or subcontractor, supplier, job applicant, etc. The protection also applies to individuals who help a whistleblower to file a report or disclose information, as well as to those related to the whistleblower who might suffer negative consequences (i.e., colleagues, relatives).

General obligations

The Whistleblowing Act imposes several obligations to employers, such as:

• Designation of an internal reporting channel;
• Adoption of internal rules for reporting that must be reviewed at least once every three years;
• Record-keeping that must also comply with the data protection laws;
• Submission of statistical information to the national external whistleblowing body in accordance with the relevant reporting procedures;
• Appointment of at least one employee responsible for handling incoming reports.

Reporting

The Whistleblowing Act applies to breaches of national or EU law which fall within specific sectors, such as public procurement, data and privacy protection, financial services, environmental protection, consumer protection, public health, and more. The Whistleblowing Act also applies to the reporting of crimes and labor-related violations. Anonymous reporting or reports related to violations committed more than two years ago are generally not allowed.

Reporting channels

The Whistleblowing Act introduces internal and external means of reporting of violations. Internal reporting occurs through the internally created reporting channel within the company or public entity. As long as there is no conflict of interests, the employee appointed to handle whistleblowing complaints may perform another function in the company or entity as well (i.e., the employee could be also a data protection officer). A complaint can be made orally or in writing.

External reporting occurs through the Commission for Personal Data Protection (the "Commission"), which is appointed as a central external whistleblowing body. For this purpose, the Commission will have established a whistleblowing unit within its structure which will handle the reports. In order to verify the reports or publicly disclosed information about violations, as well as for taking appropriate actions, the Commission will forward the reports to the competent authority (i.e., Commission for Consumer Protection, Commission for Protection of Competition, General Labour Inspectorate, National Revenue Agency, etc.).

Whistleblower Protection

The Whistleblowing Act provides a non-exhaustive list of retaliation forms against which whistleblowers are protected. These include termination of employment, delay in promotion, negative performance evaluation, disciplinary sanctions, direct or indirect discrimination, unequal treatment, and not prolonging a temporary contract. If any form of retaliation is pursued, the whistleblower will be entitled to compensation for pecuniary and non-pecuniary damages.

Sanctions

Non-compliance with the Whistleblowing Act will result in administrative sanctions for the offender. The sanctions will vary depending on the type of breach and its recurrence. Companies and entities may face a penalty between BGN 5,000 and BGN 20,000 (approx. between EUR 2,500 – EUR 10,000) for a first breach.

The Whistleblowing Act is stringent when it comes to reporting or making false information public. For knowingly reporting or making public false information, the individual faces a fine in the range BGN 3,000 – BGN 7,000 (approx. EUR 1,500 – EUR 3,500).

To learn more and to keep abreast of the upcoming changes, call or email our local CMS Sofia experts, Maria Harizanova and Ivan Gergov.