Whistleblowing Directive

On 02.02.2023, the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations was promulgated in the State Gazette. The promulgated law introduces the requirements of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (the so-called 'EU Regulation'). Whistleblowing Directive). The law enters into force as of 04.05.2023 and applies to all obliged entities, with an exception provided only for employers in the private sector who have between 50 and 249 workers or employees, to whom the law applies from December 17, 2023.

What is the purpose of the law?

The main purpose of the law is to ensure the protection of persons in the public and private sectors who report or publicly disclose information about violations of Bulgarian legislation or acts of the European Union, which became known to them in the course of or in connection with the performance of their work, also called whistleblowers.

To whom does the law provide protection and how?

In order to achieve this goal, the law provides protection to:

• any natural person who reports or publicly discloses information about an infringement that has become known to him in a work context, including in his capacity as a worker, employee, civil servant, person exercising a liberal profession, trainee, person working for a natural or legal entity, its subcontractors or suppliers, job candidate, partners, shareholders, members of management and control bodies and others;
• any person who assists the reporting person in the reporting process,
• any person who is related to the reporting person, e.g. a colleague, relative.

From the above, it is clear that the protection provided should be comprehensive in nature, including in the circle of protected persons (so-called “whistleblowers”) persons related to them, as well as persons who assist them in the process of submitting the report.

The law prohibits any form of retaliation against whistle-blowers and other protected persons, which is repressive and puts them at a disadvantage, as well as threats or attempts to do so. Forms of retaliation include, but are not limited to:

• temporary suspension, dismissal or application of other grounds for termination of the legal relationship under which a person is employed;
• demotion or delay in promotion;
• a change in the place or nature of work, the length of working hours or a reduction in remuneration;
• refusal to provide training to maintain and increase the professional qualifications of the worker or employee;
• negative assessment of work, including in a job recommendation;
• enforcement of property and/or disciplinary liability, including the imposition of disciplinary punishments;
• coercing, rejecting, threatening to take retaliatory actions or actions, expressed physically, verbally or otherwise, aimed at harming the dignity of the person and creating a hostile professional environment;
• direct or indirect discrimination, unequal or unfavourable treatment;
• withdrawal of the possibility of switching from a fixed-term employment contract to an employment contract for an indefinite period, when the worker or employee had a legal right to be offered permanent employment;
• early termination of a fixed-term employment contract or refusal to re-conclude, where such is permissible by law;
• damage, including to the person's reputation, in particular on social networks, or financial losses, including loss of business and loss of income;
• inclusion in a list drawn up on the basis of a formal or informal agreement, in a sector or industry, which may result in the person being unable to enter a job or supply a good or service in that sector or industry (blacklist);
• early termination or termination of a contract for the supply of goods or services where the person is a supplier;
• termination of a licence or authorisation;
• directing the person to undergo a medical examination.

In case of violation of this prohibition, the reporting person is entitled to compensation for the material and non-material damage suffered.

What violations can be reported?

The new law allows the following violations to be sanctioned, namely:

• Violations of Bulgarian legislation or acts of the European Union in certain areas, including but not limited to public procurement, financial services, prevention of money laundering and terrorist financing, product safety and compliance, transport safety, environmental protection, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, and security of networks and information systems.
• Infringements affecting the financial interests of the European Union and infringements of internal market rules, including EU rules and Bulgarian competition and state aid legislation.
• Infringements related to cross-border tax schemes, the purpose of which is to obtain a tax advantage contrary to the object or purpose of applicable corporate tax law.
• Committed crime of a general nature of which the reporting person became aware in connection with the performance of his work or in the performance of his official duties.
• Violations of the Bulgarian legislation in the field of the rules for payment of public state and municipal claims due, violations of labor legislation and legislation related to the performance of civil service.

For which persons does the new law provide obligations and what do they consist of?

Obligations under the new law are the following persons:

• employers in the public sector, with the exception of municipalities with a population of less than 10 000 persons or less than 50 workers or employees;
• private sector employers with 50 or more workers or employees;
• employers in the private sector regardless of the number of employees, if their activity falls within the scope of the acts of the European Union listed exhaustively in the Act (e.g. financial and insurance sectors, other public interest enterprises,

Obliged persons should take certain actions with a view to applying the law in practice, namely to:

• Establish a channel for internal reporting of violations that meets the requirements provided for in the Law.
• Adopt rules for internal reporting and follow-up, which should be reviewed and updated periodically (at least once every three years).
• Designate one or more officers responsible for examining alerts (this may be the data protection officer, and in the absence of an obligation to appoint such a person, another officer shall be appointed to deal with alerts).
• Provide individuals with clear and easily accessible information on the conditions and procedures for reporting.
• Establish and maintain a register of reports of violations and adopt an internal act for its maintenance in compliance with the regulation of the national authority for external reporting /CZLD/.
• Regularly submit the necessary statistical information to the national authority (CZLD) for external reporting in accordance with the procedure established by it.
• They perform other duties provided for in the Law.

What penalties does the law provide?

For non-fulfillment of any of the above obligations provided for in it, the law provides for different amounts of penalties, which, depending on the type of violation, range from BGN 400 to BGN 20,000 for legal persons. For repeated violations of the obligations to establish a channel for internal reporting and for periodic review and updating of the internal rules adopted in this regard, larger sanctions are provided, namely from BGN 10 000 to BGN 30 000 for legal persons.

‍

‍