On 27 January 2023, after more than a year of delay, the Bulgarian parliament adopted Act on the protection of persons who report breaches ("Whistleblowing Act"). The Whistleblowing Act finally transposes the Whistleblowing Directive (Directive (EU) 2019/1937) beyond the deadline of 17 December 2021 for all member states. The Whistleblowing Act enters into force within 3 months as from its publication in the State Gazette, which was made on 2 February 2023.
The Bulgarian Act, as required by the Directive, applies to breaches of public procurement; financial services, prevention of money laundering and terrorist financing; product safety; transport safety; environment protection; nuclear safety; food and feed safety, animal health; public health; consumer protection; personal data protection; financial interests of the EU; EU competition law and state aid regulation; cross-border tax schemes. The Bulgarian Parliament decided on a broader scope of breaches compared to the Whistleblowing Directive, where the Act applies not only to EU legislation breaches, but also to breaches of the respective provisions of Bulgarian law.
Moreover, Bulgarian Parliament decided on the application of the Whistleblowing Act to breaches of criminal law (excluding proceeding initiated by a private complaint); breaches of obligations for tax and public payments; breaches of employment legislation; breaches of public service obligations.
The Act unlike previous of its drafts, prohibits anonymous reporting and limits the period for reporting to 2 years. These two topics were subject to discussions and controversy among the members of the Act Working Group. Finally, the decision was to prevent anonymous reporting and to opt for a shorter reporting period.
Addressees of the Whistleblowing Act are all private companies with more than 50 employees and public sector entities excluding smaller municipalities with less than 10 000 citizens. Such addressees are obliged to adopt rules regulating the reporting, to create reporting channels and to organize the processing of the reporting. Irrespective of the number of the employees, certain private companies operating in the field of financial services, prevention of money laundering and financing of terrorism, transport safety, environment protection, etc., shall also comply with the requirements under the Whistleblowing Act.
The Act provides for three channels of reporting – internal, external, and public reporting. The internal reporting is within the company/public entity as per the rules for reporting adopted under the Whistleblowing Act. The external reporting is to be made to the Personal Data Protection Commission. Public reporting is to public media. The employees are free to choose the reporting channel.
Reporting employees are subject to protection, i.e., predominantly employment law protection such as prohibition for disciplinary measures, dismissals, etc. Note shall be taken, that the Whistleblowing Act adopted the minimum levels of protection set by the Directive although the member-states had the option to heighten the level of protection for the whistle-blowers.
The addressees of the Whistleblowing Act have the obligations to establish internal rules and channels for reporting, to process the signals, to take proper measures based on the reported breaches, to protect the identity of the reporting employees, etc.
As per the Whistleblowing Act, companies having more than 249 employees have 3 months to comply with the Act as from its publication in the State Gazette. Companies having between 50 and 249 employees shall comply with the Act not later than 17 December 2023. Non-compliance will lead to financial sanctions.
By Eleonora Mateina, Managing Associate, Eversheds Sutherland
