The New Whistleblower Protection Act Enters Into Force

• Jurisdiction: European Union
• Law Firm: Schoenherr Attorneys at Law
• Subject Matter: Employment and HR, Privacy, Data Protection, Whistleblowing
• Author: Tereza Shishkova and Ema Stoyanova
• Published date: 18 May 2023

On 4 May 2023 the Bulgarian Act on the protection of persons who report or make public information on breaches (Закон за защита на лицата, подаващи сигнали или публично оповестяващи информация за нарушения, "Whistleblower Protection Act" or "WPA")¹ adopted earlier this year enters into force, giving effect to the provisions of Directive (EU) 2019/1937² and imposing a number of obligations on employers in both the public and private sector.

Purpose and scope

The WPA is aimed at ensuring the protection of persons who report or make public information on breaches of Bulgarian or EU law that they have become aware of by virtue of their employment or otherwise in connection with work (commonly referred to as "whistleblowers"). Eligible for protection under the act are:

• current or former employees;
• self-employed persons;
• volunteers, interns/trainees;
• contractors;
• shareholders, members of management or supervisory bodies;
• job candidates, etc.;
• as well as persons who have aided whistleblowers with reporting and other categories of related natural/legal persons.

While the WPA provides that proceedings are not initiated with respect to anonymous reports, persons who anonymously report or disclose information on breaches but are subsequently identified and subjected to retaliation may nevertheless be eligible for protection.

Protection under the act is offered to persons reporting or disclosing information on a wide range of breaches, including those related to AML/CFT, public procurement, financial services, transport safety, data and consumer protection, environmental protection and more, as well as breaches of Bulgarian employment law. The scope of the WPA also covers reports and disclosures on any infringements related to the internal market or affecting the financial interests of the EU. Several categories of reports are explicitly excluded, such as those disclosing confidential health information, etc. Importantly, proceedings under the act are also not initiated with respect to infringements older than two years.

Employer's internal reporting channels

Under the WPA, several categories of employers are obliged to create an internal reporting channel in accordance with the specifications of the act, including by designating an employee responsible for receiving, registering, reviewing and, if necessary, referring reports externally. This obligation applies to (from date):

• employers in the public sector (except for some categories of municipalities) (4 May...