In extraordinary issue No. 11 of the Official Journal, the Act on the Protection of Persons Who Report or Publicly Disclose Information on Breaches was promulgated. This Act transposes the requirements of Directive 2019/1937 (Whistleblower Directive), albeit with a delay of more than two years.

The Act enters into force on 4 May 2023, with the provisions of Chapter Two, Section I (Articles 12–18) applying to private-sector employers having between 50 and 249 workers or employees from 17 December 2023.

Objectives of the Act

The principal objective of the Act is to ensure the protection of persons in the public and private sectors who report or publicly disclose information on breaches. The Act is aimed at protecting persons who have become aware of breaches in or in connection with the performance of their employment or official duties, or in another work-related context.

These rules are intended to prevent any reprisals and to ensure that persons who have made a report are not placed at a disadvantage. The Act provides for a national mechanism for the protection of such persons and for taking action on every report submitted.

A central authority has been designated for the reporting and the protection of reporting persons – the Commission for Personal Data Protection.

Scope of application

The Act covers information on breaches of Bulgarian legislation or acts of the European Union specified in the annex to the Act. The breaches include:

  • Public procurement.
  • Financial services, products and markets, as well as the prevention of money laundering and terrorist financing.
  • Product safety and compliance.
  • Transport safety.
  • Protection of the environment.
  • Radiation protection and nuclear safety.
  • Safety of food and feed, animal health and animal welfare.
  • Public health.
  • Consumer protection.
  • Protection of personal data and the security of networks and information systems.

In addition, the Act covers:

  • Breaches affecting the financial interests of the European Union under Article 325 of the Treaty on the Functioning of the EU.
  • Breaches of the rules of the internal market, including as regards competition and State aid.
  • Cross-border tax schemes aimed at obtaining a tax advantage that is contrary to the law.
  • Ordinary criminal offences of which the person has become aware in connection with the performance of their work.

The Act also applies to breaches of Bulgarian legislation in the field of:

  • Payment of public State and municipal receivables due.
  • Employment legislation.
  • Legislation relating to the performance of civil service.
Exceptions from the scope of application

Exceptions from the Act are allowed for reports relating to:

  • Breaches in the field of defence and national security falling within the scope of Article 346 of the Treaty on the Functioning of the EU.
  • Protection of classified information under the Protection of Classified Information Act.
  • Breaches that have become known to persons practising a legal profession and subject to professional secrecy.
  • Confidentiality of health information under the Health Act.
  • The secrecy of judicial deliberations and the rules of criminal procedure.
Conditions for protection

A person who reports a breach through an internal or external channel is entitled to protection where the following conditions are met:

  1. Reasonable belief that the information is true:
    The person must have had reasonable grounds to believe that the information reported on the breach was true at the time of reporting.

  2. Compliance with the reporting procedure:
    The report must be submitted in accordance with the rules and procedures established in the Act.

Specific conditions for the public disclosure of information

When publicly disclosing information on a breach, the person is likewise entitled to protection, but subject to the following additional conditions:

  • No action taken on the report:
    The person must have submitted a report through the channels provided for, but no action was taken on it within the established time limits.

  • Reasonable concerns about serious consequences:
    The person must have reasonable grounds to believe that:

    • The breach may constitute an imminent or manifest danger to the public interest.
    • There is a risk of damage that cannot be prevented.

  • Specific risks in submitting the report:
    The person must have grounds to believe that:

    • Where a report is submitted through an external channel, there is a risk of reprisals.
    • There is a likelihood that the report will not be dealt with effectively owing to a risk of concealment of evidence or suspicions of collusion between the authority and the perpetrator of the breach.
Important clarification

The protection under the Act covers not only the person who submitted the report but also other associated persons, such as:

  • Persons who have assisted the reporting person.
  • Relatives, colleagues or other persons who may become the target of reprisals because of the report submitted.
  • Legal entities with which the reporting person is connected in a work-related context.
Protective measures

Persons who report or publicly disclose information on breaches need protection, particularly where they are workers or employees who are often in a position of economic dependence on their employers. The Act provides for specific protection, which takes the form of a prohibition on any reprisals, including:

  • Suspension, dismissal or termination of the legal relationship.
  • Demotion or refusal of promotion.
  • Change of the place or nature of the work, reduction of remuneration or of working hours.
  • Refusal to provide training for maintaining and improving professional qualifications.
  • A negative performance appraisal or unfavourable references for future employment.
  • The imposition of pecuniary or disciplinary liability, including disciplinary penalties.
  • Coercion, threats or acts that harm the person's dignity and create a hostile working environment.
  • Discrimination or unequal treatment.
  • Refusal to conclude a permanent employment contract, where the person is entitled to such a contract.
  • Termination of a fixed-term employment contract before its expiry or refusal to renew a contract.
  • Damage to the person's reputation, including through social media.
  • Inclusion on a "blacklist" that hampers future employment or business in a particular sector.
  • Early termination of a contract for the supply of goods or services.
  • Revocation of a licence or permit.
  • Compulsory referral of the person for medical examinations.

The competent authorities are obliged to issue binding orders for the cessation of any harmful acts while the verification is ongoing.

Liabilities and penalties

In the event of a breach of the prohibition on reprisals, the Act provides for several forms of liability:

  • Pecuniary and non-pecuniary liability: The reporting person is entitled to compensation for the damage caused, and the damage is deemed to be intentional until proven otherwise.

  • Administrative liability:

    • A person who takes action for the purpose of reprisals against the reporting person or persons associated with them is liable to a fine of BGN 2,000 to 8,000.
    • A person who has knowingly submitted false information is liable to a fine of BGN 3,000 to 7,000.

In addition, an affected person who is the victim of an abuse of rights is entitled to claim compensation for the damage caused through the courts.

If you need internal reporting rules drawn up or other legal advice and assistance in connection with the obligations under this Act, contact us on tel.: 0887550706 or by e-mail: [email protected]