On 09.05.2025, in the State Gazette No 38, an Act amending and supplementing the Protection of Persons Who Report or Publicly Disclose Information on Breaches Act (the “Act”) was promulgated.
The changes are because of the inaccurate transposition of some of the provisions of Directive (EU) 2019/1937 (the “Directive”) into our national legislation, which was established as a deficincy by the European Commission (“EC”) during the negotiations in connection with the National Recovery and Resilience Plan. The adoption of the changes, among other measures, contributes to the granting of the second payment under the plan to Bulgaria.
The legislator has specified the circle of whistleblowers, and protection can now also be received by persons who are about to conclude a contract for the provision of any type of service, in cases where information about breaches was received during pre-contractual relations. Until now, the Act only granted this right to persons whose employment relationships were about to begin for information about breaches received during a recruitment process.
In addition, former shareholders, suppliers, etc., are now also protected when the information about the breach has been received by them within the framework of already terminated relationships.
A significant change with great practical application has been introduced in the Act regarding the impediments to initiating proceedings. The two-year limitation period as of the moment of the breach, upon the expiration of which whistleblowing proceedings could not have been initiated until now, is abolished. This legislative decision comes in response to the criticism of EC that the main objective of the Directive to strengthen the protection of whistleblowers would be compromised and its effectiveness reduced due to the time limit of the protection under the current version of the Act.
The negative aspect in this case is the fact that with the removal of the time limit described above, in practice, reports can be submitted in relation to breaches committed an unlimited period back in time, which creates some legal uncertainty and creates prerequisites for potential abuses. In this regard, another change has been introduced in the Act, according to which, when, in relation to the breach for which a report was submitted, the deadlines for initiating administrative-punitive or criminal proceedings have expired, respectively, the administrative-punitive or criminal liability has been extinguished by statute of limitations, the internal review on the report in accordance with the Act is terminated. In practice, the employees responsible for reviewing the reports will now have to check the relevant limitation periods, in accordance with the applicable general and special laws for each submitted report.
In fulfillment of the obligation to properly transpose the Directive, a change is also intriduced in Art. 15, para. 3 of the Act, which in its new version allows the officer receiving an oral whistleblowing report to document the latter by recording, if the explicit consent of the whistleblower is ensured. The latter is provided with an additional opportunity to check, correct and approve the information about the report recorded in writing by the officer in cases of oral submission of the same, before the whistleblower signs the completed report form.
We are also about to follow up on what amendments will be adopted by the regulatory authority with regard to the sample form for submission, respectively registration of a report.
Amendments have also been introduced with regard to the sanctions for violations under the Act. A differentiation has been introduced in the monetary amount of administrative penalties depending on the status of the violator. Sole proprietors and legal entities that violate their obligations to (timely) take follow-up actions and to protect the information related to the reports submitted and the identity of the whistleblower are punished with a property penalty in the amount of BGN 1,000 to BGN 7,000, while natural persons who violate the law – with a fine in the amount of BGN 400 to BGN 4,000. Until now, the penalty was the same for everyone - only in the reduced amount from BGN 400 to BGN 4,000.
The adopted amendments to the Act represent a significant step towards the full transposition of Directive (EU) 2019/1937 into Bulgarian legislation. It remains to be seen in practice whether the application of the new rules will achieve the expected level of protection and trust among persons reporting breaches, on the one hand, and employers, on the other.
