The new Act on the Protection of Persons Who Report or Publicly Disclose Information on Breaches (ЗЗЛПСПОИН) has designated the Commission for Personal Data Protection (КЗЛД) as the Central Authority for external reporting. The designation of a single central authority creates a better mechanism for overcoming the existing fragmentation of the legal framework for reporting and for enhancing legal certainty. This centralisation is also intended to enable more effective work on the insufficient reporting of breaches and to improve law enforcement in the areas defined by the Act, in which breaches may seriously harm the public interest.
In its new role, the Commission will organise the receipt of reports and will forward them to the competent authorities for their verification and the taking of follow-up action. It is the Commission that will approve the forms for receiving reports and will coordinate and oversee the activities of examining reports carried out by the obliged entities under Article 20 of the ЗЗЛПСПОИН, as well as by all authorities and organisations that receive or handle such reports. The КЗЛД will provide methodological guidance to the obliged entities and will conduct training for their employees responsible for examining reports under this Act. The Commission is due to adopt an ordinance on the keeping of the register under Article 18, paragraph 4 of the Act and on the forwarding of internal reports to it.
Processing of reports
The Commission maintains a register of reports, analyses and summarises the practice in handling them, and transmits the necessary statistical data to the European Commission. It will ensure the protection of persons who report or publicly disclose information on breaches, including through the application of the administrative measures provided for in the Act.
For the purposes of verifying reports and publicly disclosed information on breaches, as well as taking the appropriate action to prevent breaches or to remedy their consequences, the Commission forwards reports without delay, but no later than 7 days after receiving them, to the authority competent for the subject matter of the report. The competent authorities to which a report may be forwarded are expressly determined by Article 20, paragraph 1 of the Act, and they include the Commission for Protection of Competition, the Financial Supervision Commission, the Commission for Consumer Protection, the Minister of Finance, the Executive Director of the National Revenue Agency and others.
Where a report concerning breaches of Bulgarian legislation or of European Union law has been submitted directly to one of the authorities under Article 20 of the ЗЗЛПСПОИН, the relevant head of that authority is obliged to forward the report without delay to the Commission through the appropriate channel for external reporting. Contact with the reporting person is established without delay, but no later than 7 days, by the Commission through the unit serving as the channel for external reporting, which notifies the reporting person of the change in the addressee of their report. The handling of the report may be assigned to the same authority to which the report was initially submitted, if that authority is competent in the case, under the direction and supervision of the Commission and in compliance with the procedures provided for in the Act.
The КЗЛД forwards the report to the competent authority without disclosing information about the person who submitted the report. Where, in order to establish the truth of the facts alleged in the report, it is necessary to disclose the identity of the reporting person, the Commission may do so only after obtaining written consent from the reporting person. Upon receiving such consent, the competent authority is obliged to provide conditions for handling the report and the reporting person in strict compliance with the requirements of the Act for preserving the identity of the reporting person and for their protection. The competent authority notifies the КЗЛД of the follow-up action in connection with the report within the time limits fixed by the Act. This does not apply where the report concerns breaches committed by persons holding senior public office. In such cases, the КЗЛД refers the report for verification to the Commission for Countering Corruption and Forfeiture of Illegally Acquired Assets. The КЗЛД has the right at any time to request information from the relevant authority on the stage reached by its verification of the submitted report and to give instructions on the manner of carrying out the verification, which are binding on that authority.
Requirements for the external reporting channel
The Commission for Personal Data Protection is required to establish a channel for external reporting that guarantees:
- Completeness, integrity and confidentiality of the information: The channel must prevent access by unauthorised persons to the information submitted.
- Security of the information: Any recorded information must be stored on a durable medium for the purposes of the verification and subsequent investigations.
- Independence of the channel: It is a structurally separate unit within the КЗЛД, staffed by specially trained employees who are not permitted to disclose information about the reports and the persons who submitted them, even to other members of the Commission.
Receipt and verification of reports
The employees of the external reporting unit act in accordance with a statutorily prescribed sequence:
- Acknowledgement of the report: The reporting person receives an acknowledgement of receipt of the report, unless this would jeopardise their protection or they have expressly stated that they do not wish to receive an acknowledgement.
- Feedback: Within three months, information is provided on the action taken on the report. In complex cases, this period may be extended to six months.
- Forwarding of the report: Within 7 days, reports are forwarded to the competent authorities, and the reporting person is notified accordingly. The КЗЛД reserves the right to request additional information and to coordinate the action taken on the report.
Persons who have publicly disclosed information on breaches are provided with immediate protection upon request. The employers or other persons against whom the report is directed are notified of the protection granted and of the legal consequences of any reprisals.
Action following the verification
On the basis of a report by an employee of the external reporting unit, the head of the unit proposes to the КЗЛД the following actions:
- Taking measures to put an end to the breach, where it has been established.
- Forwarding the information to the competent institutions of the European Union, where this is provided for in EU acts. In such cases, the reporting person is notified of the forwarding within 7 days.
- Referral to the Prosecutor's Office, if the commission of an offence has been established.
- Taking measures to protect the reporting person.
- Termination of the verification in certain circumstances, such as:
- The breach is minor and does not require follow-up action.
- The report does not contain new information of substantial significance, unless new facts or circumstances justify follow-up action.
The decisions of the КЗЛД are taken in a closed session and are subject to appeal under the procedure of the Administrative Procedure Code. The Commission draws up a report on the action taken, which includes a description of the content of the report, the results of the verification and the decisions taken.
Register of reports and review of procedures
The КЗЛД establishes and maintains a register of reports, linked to the registers of the entities obliged under the Act. Once a year, the Commission organises a meeting with the authorities under Article 20 of the ЗЗЛПСПОИН in order to analyse the activity of examining reports and to collect statistical data.
The КЗЛД is subject to external audit by the Ombudsman of the Republic of Bulgaria, who receives and examines complaints from reporting persons, including complaints of failure to provide protection or breaches of confidentiality.
If you need internal reporting rules drawn up or other legal advice and assistance in connection with the obligations under this Act, contact us on tel.: 0887550706 or by e-mail: [email protected]
