On 17.12.2021, the deadline for European Union countries to align their national laws with the provisions of Directive (EU) 2019/1937 on the protection of reporting persons (eloquently known in English as The Whistleblower Directive) expires.
The Directive provides for employers to organise themselves in such a way as to give whistleblowers a safe opportunity to report breaches of the law in certain sectors without adverse consequences.
Who will benefit from the protection of the Directive?
The persons who will be able to report violations under the protection of the new rules are not only the employer's employees (full-time or part-time, permanent or temporary). Reporting persons can also be persons performing services under a civil contract, interns and, in general, persons who had the opportunity in a work context (in the broadest sense) to obtain information about the infringement. Such persons could also be contractors of the undertaking - suppliers, customers, etc.
In which areas are the violations that can be reported under the new rules?
The main piece of legislation through which Bulgaria will transpose Directive (EU) 2019/1937, the Whistleblower Protection Act, will in all likelihood concern not only violations of EU law, but also violations of Bulgarian law in the following areas:
- public procurement;
- financial services, products and markets and the prevention of money laundering and terrorist financing;
- product safety and compliance;
- transport safety; environmental protection;
- radiation protection and nuclear safety;
- food and feed safety, animal health and animal welfare;
- public health;
- consumer protection;
- protection of privacy and personal data and security of networks and information systems;
- infringements affecting the Union's financial interests and infringements relating to the internal market, including Union competition and state aid rules and corporate tax rules.
These alerts do not need to concern specific offences - a specific legal provision does not need to have been violated. They can also be unlawful practices - acts or omissions that do not appear to be formally unlawful but which are contrary to the object or purpose of the legislation.
Also, the alert is not required to relate to an actual infringement. All that is required is that the person who made it had reason to believe that the infringement was genuine.
In other words, the circle of violations that can be reported is wide and covers a serious part of the business spheres in which most of the Bulgarian companies and administration are engaged.
Which are the organisations that will need to take timely action?
The Directive introduces requirements to set up internal whistleblowing channels for any undertaking with more than 50 employees/workers. These could be either separate units within the structure of the undertaking or third parties who are competent to receive and process the alerts and who have the necessary expertise to carry out the activity envisaged under the Directive and the law to be adopted in Bulgaria.
In both cases, the person entrusted with this function will have to assess whether the alert should be forwarded to the relevant state institution or whether it does not contain sufficient evidence of a violation, as well as perform other duties in this regard to be provided for in the law under discussion.
What is the protection of whistleblowers against retaliation?
Legal protection will be granted to reporting persons in one of the following ways - by internal whistleblowing, by external whistleblowing (directly to the competent public authority) or by so-called public disclosure of wrongdoing (through media, social networks, etc., but only in explicit cases).
The term "retaliation" should be understood in its broadest sense - such is any action directed against the whistleblower that is motivated by a desire for "revenge" (this is the word used in the Directive). This could be, for example, dismissal or the refusal to recruit the person in the first place, the refusal of an expected promotion. If the reporting person is a supplier or a customer, refusal to continue contracts with that supplier, damaging that supplier's business reputation by creating a negative image of that supplier to others, etc. may be perceived as retaliatory actions. Entities belonging to the whistleblower also benefit from the protection.
Retaliation shall be presumed in all cases where any of the above or similar actions are taken against the reporting person. This assumption could be rebutted by the person who took the action if he could prove that the motive for the action was not revenge because of the report.
How is whistleblowers' personal data processed?
Reporting persons` information is covered by data protection regulations and, accordingly, its processing and storage will be subject to the high legal standards mainly set out in the GDPR. Whether this processing is carried out in-house or by an external consultant, the personal data of whistleblowers must be held lawfully and this is likely to be subject to separate scrutiny. Violation of legal requirements for the processing of the reporting persons` personal data could attract administrative and criminal liability.
What's next for business?
As the provisions of the Directive have not yet been transposed by law in Bulgaria, it is not possible to analyse with certainty what the obligations for businesses will be and in what timeframe they should bring their activities in line with the new rules.
Most certainly, companies with more than 50 employees/workers will have to set up the necessary organisation (internally or through an external consultant) in such a way as to ensure, to the maximum extent possible, the protection of whistleblowers, their anonymity (if possible), the lawful processing of reporting persons, their possible referral to the competent authorities and the protection of the rights of all participants in this procedure.
The new changes are also likely to lead to a revision of employers' internal rules, which will need to reflect the whistleblower protections, how to blow the whistle and the steps to be taken at each stage.
Last but not least, companies will need to inform whistleblowers in detail about their rights under the Directive and how to practice them, which is likely to require specialised training or the drafting of detailed orders, regulations or instructions to fulfil this function.