One of the latest obligations imposed by the state on public and private sector employers is the establishment of an internal system that allows employees and workers to report violations that have become known to them in a work-related context.
As of May 4, 2023, employers in the public and private sectors with 50 or more employees, as well as those operating within the scope of European Union acts (regardless of the number of employees), and the public sector (excluding municipalities with a population under 10,000), are obliged to create and maintain an internal channel for reporting violations within their administrative structure. This must be in compliance with the requirements of the Whistleblower Protection Act (WPA).
As obligated entities, companies must provide clear and easily accessible information about the terms and procedures for reporting violations by establishing a specific organization for internal reporting. This requires preliminary preparation and ongoing employee training.
Conditions and Procedure for Receiving, Registering, and Reviewing Reports
The conditions and procedure for receiving, registering, and reviewing reports are governed by separate internal rules, the implementation of which is the responsibility of employers. There are strict requirements for physical and documentary security, including the premises where reports are submitted or discussed. Received reports are processed in compliance with the confidentiality obligations arising from Art. 31 and Art. 32 of the WPA.
The functional duties of the employees involved in this activity are also regulated by separate rules for personal, documentary, and information security. The storage periods and the method of document destruction are also regulated by specific rules.
Each report is processed through its initial receipt and registration. After the report is officially logged, the designated employee oversees an initial formal review to determine if the report falls within the scope of Art. 3 of the special law (WPA) and if the mandatory requisites for generating a Unique Identification Number (UIN) are present.
One of the main requirements for the unit dealing with the WPA is the application of measures to protect the reporting persons. In practice, a large number of obligated entities do not meet the legal requirements – either an internal channel is not established, or it exists only formally. This not only hinders the submission of reports but also creates a prerequisite for serious financial sanctions.
The existence of a visible, prominent organization for reporting violations, or a so-called "internal channel," also brings reputational benefits by improving public trust in any organization. Therefore, it is important for every serious employer to pay due attention to this.
External Reporting Channel to the CPDP
In case of a lack of trust in the internal channel, the legislator has provided for the possibility for the whistleblower to turn directly to the Commission for Personal Data Protection (CPDP), which is the central body for external reporting and protection of persons. The Directorate "Channel for External Whistleblowing" (CEW) within the CPDP is authorized to handle reports.
The Commission for Personal Data Protection also performs supervisory functions with respect to the entities obliged to maintain internal channels.
Reports can be submitted both through the external channel (i.e., the CPDP) and the internal channel (i.e., to the employee designated to handle reports within the organization). The employees designated to review the report have a duty not to disclose the identity of the whistleblower, to avoid conflicts of interest, not to disclose data, and to protect all documents.
It is important to know that a report can be submitted both in writing and orally – by phone or after a scheduled meeting in a specially designated room. Video or audio recording during such meetings is not permissible. Every oral report is documented by the responsible employee by filling out a form. Regardless of whether the report is submitted through an external or internal channel, if it falls within the scope of Art. 3 of the WPA, the receiving person is obliged to generate a Unique Identification Number (UIN), which is entered into the form. This is done through the CPDP's website and the specially developed information system. The absence of a generated UIN is equivalent to the absence of a report and is an obstacle to starting an investigation. The form must be signed by the employee responsible for receiving the report.
The whistleblower should be aware that their report may be forwarded to another competent authority, for which they will be notified in advance, as well as about the protection and support measures they can receive.
Deadlines and Sanctions
The usual period for conducting the investigation is up to 2 months from the registration of the report, but in certain cases, this period can be extended up to 5 months by a decision of the CPDP. Both the whistleblower and the persons affected by the report are notified of the results of the investigation.
The decision in the administrative proceedings is subject to appeal under the Administrative Procedure Code (APC).
For violations under Chapter Four of the WPA, the CPDP, through the CEW directorate, conducts inspections, including on-site, with sanctions ranging from BGN 400 to BGN 30,000. The penalty notices issued as a result of the inspection are appealed under the Administrative Violations and Sanctions Act (AVSA).
How We Can Help You
The conditions, procedures, and measures for protecting whistleblowers are a specific area requiring skills and preparation. The most common problems observed are a lack of adequate support and the formalization of the process for whistleblowers. Gaps are also identified in the organization and work of obligated entities (employers) in establishing and maintaining internal reporting channels, and in some cases, such functionality is completely absent.
For these reasons, and to prevent administrative sanctions, we offer our clients comprehensive legal services throughout the entire process of establishing and maintaining internal channels in accordance with the rules of the WPA. This includes preparing the necessary documents and rules, training staff, and providing procedural representation in administrative proceedings before the CPDP and the administrative courts.
We also develop a specific approach to support and protect both the persons reporting violations and those directly or indirectly affected by the abuse of rights under the WPA.
Legal Sources
- Whistleblower Protection Act (WPA / ЗЗЛПСПОИН) — Bulgarian legislation
- Directive (EU) 2019/1937 — on the protection of persons who report breaches of Union law
- Commission for Personal Data Protection (CPDP) — supervisory authority under WPA