LEGAL ALERT – WHISTLEBLOWING AND PROTECTION OF REPORTING EMPLOYEES

In 2019 the European Union adopted the so-called Whistleblowing Directive[1]. The Directive’s primary aims are to (i) ensure a minimum set of standards that would promote sufficient protection to the so-called whistleblowers – persons (mostly employees) reporting wrongdoings and (ii) encourage them to undertake actions and report.

More than a year after the term for transposition and a few bills later the Bulgarian Parliament finally adopted a new law providing regulations and administrative provisions necessary to comply with the Directive.

The new Protection of Persons Reporting or Publicly Disclosing Misconduct Information Act (the “Law”) provides for the rules on the protection of whistleblowers in Bulgaria and the obligations of the enterprises to create and support internal channels for wrongdoings reporting such as:

• Following the discretion given under the Directive, Bulgaria has opted for scope expansion by granting protection in case of reporting of breaches of the national legislation

• The Law applies to all private companies having 50 or more employees. Certain businesses under this minimum that will be also obliged to comply as well. Companies having 250 employees and more should comply with the new Law within the next three months and those with 50-249 employees – by 17.12.2023

• The provisions for whistleblowers’ protection forbid dismissal or any other termination of employment/civil or other contracts, discrimination, downgrades, payment decrease, change of place of work, working time and/or nature of work, engaging disciplinary liability, bad work reference or evaluation, etc. However, the Law does not fix an explicit term for this protection and the implementation in practice will be quite challenging

• The Law explicitly prohibits any covenants that may lead to exclusion or limitation of the rights granted to the whistleblowers. In the long run, this may call for revision of employment agreements and/or NDA agreements

• Following the Directive, the Law sets internal and external reporting channels. The companies-employers should ensure internal reporting channel. This should be carefully considered both as a compliance matter and as a way to micro manage reports internally to the possible extent

• The Law provides for specific rules and report analysis sequence regarding the administration, processing and resolution of the reports

• The controlling authority, which will also be providing the external reporting channel option is the Personal Data Protection Commission which emphasizes on the importance of simultaneous compliance with the GDRP rules for data protection

In summary: the new Law raises number of practical questions. However, the terms for compliance are already running and in the next few months we are expecting more detailed rules and guidelines from the authorities.

This material represents a high-level overview of the recent developments concerning the protection of whistleblowers in the Republic of Bulgaria. This newsletter shall not be construed as legal or other professional advice for any specific case.

For more information and legal assistance regarding the above, please contact us at:

tel.. +359 (0)2 903 01 01

email: office@drp-legal.com

[1] Directive EU 2019/1937 of the European Parliament and of the Council of 23^rd of October 2019 on the protection of persons who report breaches of the Union law