March 2023 – The Bulgarian Parliament has passed an Act on protection of persons who report breaches or publicly disclose information on violations (the “Whistleblowing Act”, the “Act”), implementing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.
The Whistleblowing Act will become effective as of 4 May 2023 and aims to protect persons reporting breaches of Bulgarian law and / or EU law. It has a wider scope than the EU Whistleblowing Directive: the Whistleblowing Act extends protection under national law to include reporting on breaches in the areas of labour law and general criminal law.
What this means for you?
If your company is:
- A private sector employer with 50 or more employees; or
- A private sector employer, irrespective of the number of employees, with activity within the financial and insurance sectors or persons liable under the Anti-Money Laundering Act, etc. (with business falling under certain European Union acts listed exhaustively in the Act).
You must:
- Establish an internal whistleblowing channel that meets the requirements set out in the Act;
- Adopt rules for internal whistleblowing and update them periodically (at least every three years);
- Designate one or more officers in charge of receiving and responding to whistleblowing signals (this may be also the data protection officer, if present);
- Provide clear and easily accessible information on the procedure for submitting whistleblowing signals;
- Establish and maintain a register of whistleblowing signals and accept an internal regulation for its maintenance in accordance with the guidelines of the Bulgarian Commission on Personal Data Protection on external whistleblowing;
- Regularly submit the necessary statistical information to Bulgarian Commission on Personal Data Protection in accordance with the established procedure.
Special considerations
In certain cases employers in the private sector with a total of 50 to 249 employees may share internal whistleblowing channel.
Employers in the private sector may delegate the functions of receiving and registering whistleblowing signals to an external provider or may use an internal whistleblowing channel established by the economic group to which they belong, if the channel meets the requirements of the Act.
Consequences in case of non-compliance
The Act provides for different levels of penalties for breach of obligations, which, depending on the type of violation, range from BGN 400 (approx. EUR 200) to BGN 20,000 (approx. EUR 10,000) for legal entities. For repeated breaches of the obligation to establish an internal whistleblowing channel sanctions for legal entities range between BGN 10,000 (approx. EUR 5,000) to BGN 30,000 (approx. EUR 15,000).
Actions to take
If your Company has between 50 and 249 employees, you must ensure compliance with the new rules by 17 December 2023.
If your Company has more than 249 employees, you must ensure compliance with the new rules by 4 May 2023.
Any group-level whistleblowing policy that may already exist must be reviewed to ensure that it fulfils the requirements of Bulgarian law.
For more information and tailored legal advice, please contact Radoslav Chemshirov, Of Counsel, at .