European Union

Source: FRA

The European Union (EU) is an economic and political union between 27 European countries with its roots in several treaties signed in the aftermath of the Second World War based on the idea that countries that trade with one another become economically interdependent and so are more likely to avoid conflict. The result was the European Economic Community, created in 1958 between six countries. Since then, 22 more countries have joined (the United Kingdom left the EU on 31 January 2020).

It began as a purely economic union and is now an organisation spanning different policy areas – from climate, environment and health to external relations and security, justice and migration. More than 340 million EU citizens in 19 countries use the euro as their currency.

All EU citizens have the right to choose in which EU country they want to study, work or retire. Every EU country must treat EU citizens in exactly the same way as its own citizens when it comes to matters of employment, social security and tax. The EU’s main economic engine is the single market (the internal market enabling goods, services, money and people to move freely).

The EU aims to have its governing institutions more transparent and democratic by giving more powers to the directly elected European Parliament, while national parliaments play a significant role, working alongside the EU institutions. The EU is governed by the principle of representative democracy, with citizens directly represented at the EU level in the European Parliament and Member States represented in the European Council and the Council of the European Union.

The EU is based on the rule of law. All citizens have equal right before the law and everything the EU does is founded on the Treaties, which are voluntarily and democratically agreed by its Member States. The EU Member States have given final jurisdiction in matters of EU law to the Court of Justice of the European Union (CJEU), whose judgments have to be respected by all.

As enshrined in the Treaty on European Union, ‘The Union is founded on the values of respect for human dignity, freedom, democracy, equality, the rule of law and respect for human rights, including the rights of persons belonging to minorities. These values are common to the Member States in a society in which pluralism, non-discrimination, tolerance, justice, solidarity and equality between women and men prevail.’ Human dignity constitutes the basis of fundamental rights; it must be respected and protected.

Human rights in the EU are protected by the EU Treaties and the EU Charter of Fundamental Rights. People can also submit complaints and enquiries concerning the application of EU law by the EU institutions themselves to the European Ombudsman.

The Ombudsman of the Republic of Bulgaria, like other National Human Rights Institutions (NHRIs) in EU Member States, monitors (together with other national institutions) the application in Bulgaria of EU fundamental rights law, including the following EU instruments:

1. Charter of Fundamental Rights of the European Union (EU Charter)
2. European Pillar of Social Rights
3. General Data Protection Regulation (GDPR)
4. Whistleblowers Directive
5. AI Act

1. Charter of Fundamental Rights of the European Union (EU Charter) 

The Charter of Fundamental Rights of 2009 is the European Union’s bill of human rights. Its 50 articles bring together the rights and freedoms belonging to everyone in the EU. General provisions in the Charter set out its detailed interpretation and application.

The Charter of Fundamental Rights binds Member States “only when implementing Union law”. But EU law often applies at national level. It influences significant parts of Member States’ law and policymaking. This makes judges, politicians, government officials and legal practitioners core Charter agents.

Explanatory notes relating to the Charter of Fundamental Rights which provide guidance on the meaning of the Charter's provisions. The European Commission has also issued Guidelines on ensuring compliance with the Charter of Fundamental Rights of the European Union in the context of the absorption of European Structural and Investment Funds ("ESI Funds") (2016/C 269/01), which provide clarification to Member States on the importance of compliance with the Charter and assist them in reviewing measures related to the absorption of EU funds.

At EU level, the EU Fundamental Rights Agency (FRA) provides independent, evidence-based recommendations to decision-makers at European and national level, thereby contributing to better informed and targeted fundamental rights debates, policies and legislation. FRA's website hosts an online tool, Charterpedia, which includes international, EU and national Constitutional law on fundamental rights related to the themes, chapters and articles of the Charter. Application of the Charter is central to the proper implementation of EU law. FRA’s handbook on Applying the Charter of Fundamental Rights offers guidance.

2. European Pillar of Social Rights

The European Pillar of Social Rights (EPSR) is a set of 20 key principles and rights in the labor markets and welfare systems areas. The EPSR is the first set of rights proclaimed by EU institutions since the Charter of Fundamental Rights. It focuses on fair working conditions, equal opportunities, social inclusion and protection. The EU's Action Plan of the European Pillar of Social Rights sets out initiatives based on the Pillar of Social Rights by 2030 incl. on socially just and fair climate neutrality, digitalization, and demographic change.

3. General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) updated and modernised the principles of the 1995 Data Protection Directive. It was adopted in 2016 and entered into application in May 2018. The GDPR governs how the personal data of individuals in the EU may be processed and transferred.

The GDPR defines:

• individuals’ fundamental rights in the digital age;
• the obligations of those processing data;
• methods for ensuring compliance;
• sanctions for those in breach of the rules.

The GDPR lists the rights of the individuals whose personal data is being processed (data subjects):

• the need for an individual's clear consent to the processing of his or her personal data;
• easier access for the data subject to his or her personal data;
• the right to rectification, to erasure and ‘to be forgotten’;
• the right to object, including to the use of personal data for the purposes of ‘profiling’;
• the right to data portability from one service provider to another.

In Bulgaria, the Personal Data Protection Act (PDPA) was adopted based on the GDPR. In Bulgaria, the Commission for Personal Data Protection monitors complaince with the GDPR.

4. Whistleblowers Protection Directive

Directive 2019/1937 on the protection of persons who report breaches of Union law (the ‘Whistleblower Protection Directive’) sets minimum standards at EU level, aiming to guarantee a high level of balanced and effective protection for persons reporting on breaches of rules (e.g. on public procurement, financial services, anti-money laundering, food safety, transport safety, consumer protection,  protection of the environment, or public health).

The Directive requires Member States to ensure, among others, that:

• whistleblowers have at their disposal effective channels to report breaches of EU rules confidentially, both internally (within an organisation) and externally (to a competent authority);
• whistleblowers’ reports are properly investigated and acted upon by the organisations and competent authorities;
• whistleblowers are protected from retaliation.

In 2023 the Ombudsman of the Republic of Bulgaria took on a new role with the mandate to conduct external audits of whistleblowing activities and whistleblower protection under Article 30 of the Whistleblowers Protection Act, as well as to receive and review complaints against the Commission for Personal Data Protection (CPDP/КЗЛД), including for failure to protect whistleblowers or confidentiality breaches.

The Ombudsman conducts on-site checks of the work of the external whistleblowing channel (the CPDP), which includes evaluating: deadline compliance with whistleblowers’ protection requests; the quality of interaction between the CPDP and the other competent authorities (as per Article 20 of WPA); compliance of the CPDP’s registers with the WPA; and other aspects of the CPDP's activities that allow for an assessment of its whistleblowing protection work’s effectiveness (Article 30(1) and (2) of WPA). 

In its annual report to the National Assembly, the Ombudsman includes information on its audits of CPDP's performance in implementing the WPA.

More information on the Ombudsman's external audits of whistleblowing activities and whistleblower protection can be found HERE.

5. AI Act (Regulation 2024/1689 laying down harmonised rules on artificial intelligence)

Regulation 2024/1689 laying down harmonised rules on artificial intelligence (The AI Act) sets out a clear set of risk-based rules for AI developers and deployers regarding specific uses of AI. The AI Act aims to support the development of trustworthy, safe, fundamental rights and human-centric AI, and strengthen uptake, investment and innovation in AI across the EU. The AI Act defines 4 levels of risk for AI systems: unacceptable risk; high risk; limited risk; minimal risk.

The AI Act entered into force on 1 August 2024, and is to be fully applicable 2 years later on 2 August 2026, with some exceptions: 

• prohibitions and AI literacy obligations entered into application from 2 February 2025
• the governance rules and the obligations for general-purpose AI models become applicable on 2 August 2025
• the rules for high-risk AI systems - embedded into regulated products - have an extended transition period until 2 August 2027

Article 77 of the AI Act requires that EU Member States appoint national authorities responsible to enforce or supervise Union laws intended to protect fundamental rights in relation to the use of high-risk AI systems referred to in Annex III, should have access to the data collected in the market surveillance of AI systems where this is necessary to effectively perform their task and supervise and enforce obligations under such other laws.

Accordingly, since 2025 the Ombudsman of the Republic of Bulgaria is among Bulgaria’s designated fundamental rights authorities under Article 77 of the AI Act. In contrast, Bulgaria's appointment of a market surveillance authority under Article 70 of the AI Act is pending.

What are fundamental rights?

Fundamental rights are the basic rights and freedoms that belong to everyone in the EU, which was founded on the values of human rights, equality, rule of law, democracy, freedom and human dignity. They are the same no matter where you’re from, what you believe or how you live. They set standards for how we live and work in the European Union today.

Fundamental rights are at the heart of the EU and are enshrined the Charter of Fundamental Rights. The EU's Fundamental Rights Agency (FRA) was set up to protect and promote them.

The term ‘human rights’ refers to all civil, political, economic, social and cultural rights as laid down in international legal instruments. The term ‘fundamental rights’ refers to the rights that are included in the EU Charter of Fundamental Rights and reflected in the general principles of EU law.