On 21.04.2022, a new bill was announced for public consultation, prepared to introduce the requirements of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of whistleblowers Union law.
The main aspects of the new bill are discussed in detail in this article by Kostadin Maslenishki – a legal consultant from the “New I” JSC team.
The “New I” JSC team remains available for assistance and additional information related to Directive (EU) 2019/1937 and the future Whistleblower Protection Act.
*This text does not constitute legal advice and should not be taken into account in resolving legal disputes, but is intended only to inform readers.
All private sector employers with more than 50 workers or employees, regardless of the nature of their activities, will be required to establish internal whistleblowing channels.
Obliged persons under the law will also be all private sector employers with less than 50 workers or employees, if their activity falls under any of the explicitly mentioned EU acts (for example those related to the regulation of capital markets, banking, lending, investment, insurance and reinsurance, occupational or personal pensions, securities, investment funds, payment services, etc.), as well as all public sector employers, excluding municipalities with less than 10,000 residents.
! Note: Employers who do not comply with this requirement are subject to fines of BGN 1,000 to BGN 5,000 for individuals and BGN 5,000 to BGN 20,000 for legal entities. In case of repeated violation, the sanction is from BGN 5,000 to BGN 10,000 for individuals and BGN 10,000 to BGN 30,000 for legal entities. Several fines are also provided for persons who do not comply with other requirements of the future law, which we will consider below.
II. SUBJECT AND OBJECTIVES
Individuals who work for or are in contact with a public or private organization are often the first to learn of threats or harm to the public interest arising in that context. By reporting violations, these individuals play a key role in detecting and preventing them. However, they often refrain from reporting for fear of retaliation. Therefore, providing effective protection to these persons comes to the fore, both at the EU level and at the national level in the Member States.
In this regard, the main purpose of the new draft law is to ensure the protection of persons in the public and private sectors who file reports or make public information about violations of Bulgarian legislation or EU acts, which became known to them during or on the occasion of carrying out their work or performance of their official duties.
III. TYPES OF SIGNALS SUBJECT TO PROTECTION
The scope of the draft law, in terms of the types of reports for which protection is provided, is quite broad. Among the main categories are whistleblowing related to public procurement, financial services, products and markets, prevention of money laundering, environmental protection, public health, consumer protection, transport safety, privacy protection and personal data, security of networks and information systems, etc.
Exceptions to the bill’s application are made regarding the protection of classified information, attorney privilege, the confidentiality of health information, the confidentiality of judicial deliberations, and several other major confidential categories of information.
IV. PROTECTED PERSONS
Whistleblowers or whistleblowers who are intended to be protected also fall into the widest possible range of categories. They can be both workers and employees, as well as persons who work without an employment relationship and/or exercise a free profession and/or craft activity, volunteers, trainees, partners, shareholders, sole owners of the capital, members of management or control bodies of a commercial company, persons who work for a natural or legal person, its subcontractors and suppliers, job applicants who participated in a competition or other form of selection for employment and in this capacity received information about a violation, as well as workers or employees when the information was received within the framework of a terminated employment or service relationship.
Moreover, the draft law envisages providing protection not only to whistleblowers but also to all those who helped them in the whistleblowing process, as well as to those who, although they did not help them, are related to them and can be subject to retaliation for whistleblowing.
V. CONDITIONS FOR RECEIVING PROTECTION
Limit malicious whistleblowing provides several additional features regarding the information that the whistleblower submits. Specifically, whistleblowers are required to have reasonable grounds to believe that the information they are reporting is correct at the time the report is made. This is an important safeguard against malicious or abusive whistleblowing, ensuring that those who knowingly submit false information are not protected. At the same time, it ensures that the whistleblower will not be deprived of protection in the event of an inaccurate whistleblower due to inadvertent error. Also, whistleblowers should have reasonable grounds to believe that the information they have reported falls within the scope of the bill. Finally, the procedure and conditions for reporting signals provided in the draft law must be observed.
VI. DIFFERENCES BETWEEN THE CURRENT SIGNALING RULE AND THE PROPOSED CHANGES
There are currently dozens of different bodies with whistleblowing powers in different areas of the public sector, depending on the nature of the offence. Such are, for example, the ombudsman, the National Security State Agency, the Commission for Energy and Water Regulation, the Executive Agency for Labor Inspection, the Commission for Financial Supervision, etc.
To improve both the scope and the volume of the signals submitted, leading to the successful prevention or cessation of violations, the draft law envisages the creation of both channels for internal submission of information about violations by the above-mentioned obligated persons – employers, as well as of channels for external reporting of signals directly to the competent state authorities, as well as the so-called “public disclosure” of information about violations.
The intended public disclosure can be made, for example, through online platforms, social networks, media, civil society organizations or trade unions. Thus, for the first time in Bulgarian legislation, special rules are created for public disclosure of information about violations.
Whistleblowers have the opportunity to choose the most convenient and safe way for them to submit a report, and this can be a combination of the listed.
VII. INTERNAL SIGNAL FEEDING
The purpose of this bill is to encourage individuals to use internal whistleblowing channels in the first place. In this way, both the negative consequences for the organisation in terms of reputation are limited, and the employee-employer relationship is strengthened based on trust and inner conviction that the relevant problem can be effectively and efficiently resolved with the maximum degree of confidentiality.
As mentioned, employers will be required to establish an internal whistleblowing channel that is managed in a way that ensures the completeness, integrity and confidentiality of the information and prevents unauthorised persons from accessing that information. Each employer will have to designate a whistleblower – an individual or a separate unit within its structure or an external individual or organisation.
VIII. EXTERNAL SIGNALS
Regardless of the possibility of reporting through an internal channel, if the person considers that there is a risk of retaliatory actions for him and/or no effective measures will be taken to verify the report, he can use an external channel to report to a state authority.
One of the main ideas of future legislation in this area is to define a single central authority that will be responsible for processing reports of violations covered by the bill. This is a good mechanism to deal with the existing fragmentation of the current legal framework in terms of whistleblowing and increasing legal certainty. The draft law proposes that the Commission for Combating Corruption and Confiscation of Illegally Acquired Property (CCCIAP) act as a central authority for external whistleblowing. Control of the Commission’s decisions on the inspections carried out is also foreseen, and the same are subject to appeal following the Code of Administrative Procedure.
IX. COMMON MOMENTS IN INTERNAL AND EXTERNAL SIGNALING
In both types of whistleblowing, whistleblowing can be done in writing, orally, or both. The report can also be submitted anonymously. Employers and CCCIAP will have to create and maintain registers of received reports of violations, which will not be public.
Administrators of signals at employers, as well as employees of CCCIAP, processing the reports, will have to carry out a check within a predetermined maximum period (3 months, and for CCCIAP, in exceptional cases – 6 months) after receiving the signal, which ends with taking specific measures to stop or prevent the violation, in the cases where it has been found; forwarding the signal to a competent authority body or termination of the inspection due to lack of sufficient data of a violation or of a real danger of committing one.
The handlers of the report are obliged both to confirm its receipt and to notify the whistleblower and the affected person (against whom the report was filed) of the actions taken, after the completion of the investigation. This ensures the traceability of the development of the investigation on the signal and prevents the possibility of not reaching a ruling on it.
Any processing of personal data carried out about the relationships regulated by the Bill will have to be carried out by Regulation (EU) 2016/679 (General Data Protection Regulation) and the Personal Data Protection Act. The rules for the protection of personal data should apply both to the whistleblowers and to the persons against whom the reports have been filed.
X. MEASURES TO PROVIDE PROTECTION
The draft law prohibits any form of retaliatory action against protected persons, as well as threats or attempts to do so, such as temporary suspension, dismissal, demotion, change of location or nature of work, reduction of remuneration, negative evaluation of the work, including in a recommendation for work at another employer, threatening to take retaliatory actions, direct or indirect discrimination, damage, including to the person’s reputation, in particular in social networks, etc.
In case of violation of this prohibition, the protected person has the right to compensation for the material and non-material damages suffered. In addition, additional measures supporting the protected person are foreseen, such as – easier access to information and advice on procedures and means of legal protection, access to legal aid in criminal, civil and international disputes in civil cases by the Law on Legal Aid, reversal of the burden of proof in legal proceedings (presumption that the harm caused to the protected person was caused intentionally), etc. It is also provided that when a protected person has legal proceedings for defamation, infringement of copyright, trade secrets, confidentiality and protection of personal data, in connection with a signal submitted by him or publicly disclosed information, he has the right to request a termination of that proceeding if there was reasonable cause to believe that the filing of the report or public disclosure of the information was necessary to uncover a violation.
The affected person against whom a report containing false information is knowingly filed will also be entitled to compensation for all pecuniary and non-pecuniary damages.
As we mentioned at the beginning of the article, in addition to the sanctions provided for employers who have not complied with the requirement to create internal whistleblowing channels, the draft law also provides for sanctions for several other violations. These sanctions are fines for:
• Obstructing or attempting to obstruct the submission of a report or failure to take the necessary follow-up actions in connection with a submitted report (from BGN 400 to 4,000);
• Taking action with the aim of revenge against the person who filed the report or a person related to him or to initiate proceedings, if it is done only to damage the other party (from BGN 2,000 to BGN 8,000);
• Violation of the rules for the protection of personal data (from BGN 400 to BGN 4,000);
• Deliberate reporting or public disclosure of false information (from BGN 3,000 to BGN 7,000);