- General exposition of the law. Subject scope.
On 2 February 2023, the Act on the Protection of Whistleblowers or Public Disclosers, adopted by the 48th National Assembly on 27 January 2023, was promulgated in Official Journal No. 11.
The scope of application of the act is set out in Article 3, covering violations of Bulgarian and EU legislation in the areas listed by the act, such as public procurement, financial services, public health, consumer protection, etc.
The act aims to provide protection to whistleblowers and to assisting and/or related parties, including legal entities with which the whistleblower is associated.
In order to receive protection under the Act, a person must have acted in good faith, i.e., believed the information to be true and within the scope of the Act, and submitted the information in the manner provided by the Act.
There are two ways of making a whistleblowing report – through an internal or external channel. There is a third option for the person to make the information public if no action has been taken within a specified time after the tip-off, there is a risk of irreparable harm or there is an imminent or manifest danger to public order, and if there is a risk of reprisal or concealment/destruction of evidence.
Proceedings shall not be initiated in respect of anonymous signals or signals relating to offences committed more than two years prior.
- Personal scope. Internal signal channel.
Public sector employers, private sector employers with more than 50 employees, and those whose activities fall within the areas specified by the act – mainly financial services, products and markets, regardless of the number of employees – are required to establish internal whistleblowing channels. These entities are obliged to maintain a non-public register of whistleblowers and to submit statistical information to the national authority, the Data Protection Commission (DPC).
The internal whistleblowing channel must meet the following requirements:
- be managed in a way that ensures the completeness, integrity and confidentiality of the information and prevents unauthorized persons from accessing this information;
- enable the storage of information recorded on a durable medium for the purposes of the alert investigation and for further investigations.
To this end, obliged persons shall establish internal whistleblowing and follow-up rules, which they shall review at least every three years.
The alert shall be received by a designated person responsible for its handling. It may be submitted in writing or orally, including by telephone or in person.
For the registration of alerts, obliged entities shall use a form approved by the national external whistleblowing body (DPC), which shall contain at least the following data:
- the full name, address and telephone number of the whistleblower, as well as an e-mail address, if available;
- the name of the whistleblower and his/her place of work if the whistleblowing is against specific persons and they are known;
- specific data of the offence or of a real risk of an offence being committed, the place and period of the offence, if any, a description of the act or the situation and other circumstances, in so far as such are known to the person making the report;
- the date on which the signal was given;
- signature, electronic signature or other identification of the whistleblower.
The national authority is the Data Protection Commission, which has not yet approved a form.
In case of irregularities in the signal, e.g. lack of information required by law, a deadline of 7 days is given for their correction.
The person examining the signal shall carry out an internal check, hearing the person against whom the signal has been lodged if it is against a specific person and taking action if within his/her competence. The signal may be forwarded to the external body if necessary or to the Public Prosecution Service if it contains evidence of a criminal offence.
On the basis of the investigation results, action shall be taken within the competence of the obliged person.
- Persons handling the signal received by an internal channel
The persons handling the signal may be the employees responsible for the processing and protection of personal data or, in the absence thereof, any other person who would not have a conflict of interest in carrying out other activities assigned by the employer. Conflicts of interest are assessed on a case-by-case basis, which means that a whistleblowing against the company’s senior management would be difficult to deal with objectively or to take adequate action on.
The act provides for the possibility for persons obliged to establish an internal channel to outsource the functions of receiving and registering whistleblowing to another natural or legal person outside their structure or to use a channel established by the economic group to which they belong. The channel should meet all the requirements of the act and the relationship between the obliged person and the person providing the channel should be governed by a contract.
- External signal channel
The central authority for external whistleblowing is the DPC, whose function is to forward the received whistleblowing to the competent authority, without disclosing the details of the whistleblower. In the event that it is necessary to disclose the identity of the whistleblower, the DPC will only do so after written authorization from the person, unless it concerns persons holding senior public office.
The Commission has the right to be informed at any time of the stage of the investigation carried out by the competent authority.
The DPC publishes on its website information on how to report, procedures, confidentiality and other information required by law. It provides methodological guidance to the persons responsible, conducts training, approves forms, etc. A separate structural unit is established within the Commission to receive and administer signals.
- Measures to protect and support whistleblowers
The act protects whistleblowers by prohibiting any retaliation against them. The main forms of retaliation relate to persons in employment (removal from employment, dismissal, transfer, etc.), but the act also provides for so-called reputational harm, including on social media, as well as harm to personal dignity and the creation of a hostile professional environment.
Therefore, the scope of damages includes both pecuniary and non-pecuniary damages.
In addition to protection, individuals are also entitled to support in the form of free advice and information, legal aid under the Legal Aid Act, mediation in dispute resolution, etc.
Whistleblowers are exempted from liability for obtaining the information, unless obtaining the information constitutes an independent offence.
Where a person is the subject of criminal, civil or administrative proceedings in connection with a whistleblowing or public disclosure of information made by him or her, he or she has the right to request that those proceedings be discontinued if there was reasonable cause to believe that the whistleblowing or public disclosure of the information was necessary to disclose an offence.
It is important to note that in a trial against him, the person must prove that the actions were taken against him in response to the whistleblowing, i.e. the burden of proof is on the whistleblower, which significantly worsens his situation, as proving this fact may prove difficult.
The person/entity subject to the signal is also entitled to compensation if the whistleblower acted in bad faith in knowing or ought to have assumed that the information in the whistleblowing was false.
- Administrative liability
The law provides for fines and financial penalties for persons who fail to comply with their obligations under it.
Legal entities obliged to establish an internal whistleblowing channel are threatened with a pecuniary sanction of between BGN 5,000 and BGN 20,000 if they fail to do so. If repeated, the penalty is between BGN 10 000 and BGN 30 000.
A fine of between BGN 3,000 and BGN 7,000 is provided for knowingly false whistleblowing or disclosure of information.
Fines are provided for persons obstructing the investigation of a whistleblower or failing to take appropriate action in a timely manner, as well as for those who retaliate against the whistleblower.
The President of the DPC is competent to issue the penalty order.
The drawing up of the acts, the issuing, the appeal and the execution of the penalty decrees shall be carried out in accordance with the Administrative Offences and Penalties Act.
- Entry into force
The Act enters into force three months after its promulgation in the Official Journal, i.e. on 2 May 2023, with the obligations of private sector employers with between 50 and 249 employees applying from 17 December 2023.
The deadline for employers in the private sector is in line with the obligation of the DPC within six months of the promulgation to adopt a regulation to approve methodological guidelines for obliged entities, to adopt a model form for the submission of whistleblowing and to regulate the operation of the register for the reception of whistleblowing.
