News

The Ombudsman institution has made recommendations to the legislative, executive and judicial branches following the Second Annual Report of the external audit of the Personal Data Protection Commission (PDPC), which is the Central Authority for External Reporting under the Whistleblower Protection Act.

Let us recall that the Whistleblower Protection Act has been in force since 2023; through its adoption, Bulgaria transposes Directive (EU) 2019/1937. An amendment to the Ombudsman Act extended the powers of the institution by mandating an external audit of the work and whistleblower protection activities. To this end, the new Directorate for Audit of Whistleblowing and Protection of Whistleblowers was established at the Ombudsman institution which, in 2024, was able to build the capacity to work and establish rules for an independent external audit of the activities of the Central Authority for External Whistleblowing and Whistleblower Protection under Article 19 of the Whistleblower Protection Act.

The main purpose of this law is to provide protection to persons in the public and private sectors who report or make public information about violations of the Bulgarian or EU legislation that have come to their attention in the course of their work. At EU level, whistleblowing and public disclosures by whistleblowers are an important tool for the application of EU law and policies.

Under this law, protection must be afforded to a wide range of people who may be subject to retaliation following a whistleblower report, in light of the existing “imbalance of power” as regards the affected individuals against whom these reports are made. The protection consists of prohibiting retaliation, which may take the form of dismissal, demotion, disciplinary action, early termination, etc. Such whistleblowing can be for breaches of labour law, competition protection, consumer protection, etc.

Pursuant to the Whistleblower Protection Act, the Ombudsman institution has a duty to inspect the PDPC and ensure that the Central Authority for External Whistleblowing complies with its statutory obligations relating to the processing of signals and the protection of whistleblowers under the Whistleblower Protection Act.

During the inspection, the Ombudsman’s team found that the PDPC considered the disclosure of identity as a necessary condition to provide full protection. Article 5 of the Whistleblower Protection Act and Directive (EU) 2019/1937 (“the Directive”) imply that the protection is to be granted from the moment a signal is made. The audit team found that it was granted only when specifically requested. Pursuant to the Whistleblower Protection Act, the norm is to keep the identity undisclosed while, according to the practice of the PDPC, the norm is to disclose it in order to provide protection. That is, a distinction is made in the scope of protection that does not resonate with the meaning and objectives of the Directive. It points out that the protection of identity is one of the most crucial points and it is disclosed exceptionally, only when necessary and proportionate.

Another finding of the report is that the law does not contain a procedure and specifics as to the scope of corrective measures. As a result of this gap in the legislation, the competent authorities are hesitant and remedies which are key to the Directive and the Whistleblower Protection Act are not implemented.

It is unclear what support measures are provided by the External Whistleblowing Channel Directorate at the PDPC. The support measures consist solely of sending three attachments whose content is identical to the Whistleblower Protection Act and repeats its text. They do not answer essential questions that a whistleblower would ask: “what actions” can be taken to obtain support and protection; “how”; “under what conditions”; “through whom”; “when” and “where”.

Furthermore, whistleblowers seeking legal aid under the Legal Aid Act follow the general procedure for its provision, i.e., by definition it is not free of charge for them.

“This category of persons is not included in the categories of persons under Article 22 of the Legal Aid Act and, de facto, there is no facilitation of the application procedure and no added benefit for whistleblowers. At the same time, these persons are likely to be under psychological pressure in connection with the signals, especially when their identity has been revealed and/or retaliatory action has been taken,” the Ombudsman team emphasises.

A conflict was found between the time limits for inspection provided for in the law and the time limits under the special laws of certain competent authorities, and nowhere is their obligation to comply with the Whistleblower Protection Act as a special law set out. There are authorities that should be included in Article 20 of the Whistleblower Protection Act but are not mentioned, e.g., the Public Financial Inspection Agency and the PDPC.

The Ombudsman team also points out that there are problems with delays in timely recording of signals, with statistics, with additional administrative steps that increase the risk of exceeding the deadlines under the Whistleblower Protection Act.

The examination of signals revealed that the deadline for referral to the competent authorities (Article 20, paragraph 1 of the Whistleblower Protection Act) had been exceeded; according to it, this must be done “immediately, but not later than 7 days”.

The specific recommendations of the Ombudsman’s review team to the PDPC, the legislature, the executive and the Supreme Judicial Council are available in the report.