Information on the conditions and procedures for reporting under the Whistleblower Protection or Whistleblower Public Information Act (PWIPIA)
- Who can report?
- What is the procedure and method for filing a whistleblower report under the HIPAA?
- What protection does the law provide for whistleblowers?
The information on this page applies to individuals and signals that simultaneously meet the following three conditions :
- you are a current or former employee of the CPD, a public official, or any other person who, in relation to the Commission, has any of the capacities listed in section 5 of the Whistleblower Protection and Public Disclosure Act (WPIPDA), and
- the information about the breach has come to your attention in a work context and
- the alert relates to violations of Bulgarian legislation or EU acts in the areas referred to in Article 3 of the HIPAA.
The Whistleblower Protection and Public Disclosure Act (PWIPDA), promulgated by Pub. SG 11/02/2023, in force as of 04.05.2023, shall apply to whistleblowing or public disclosure of information on: violations of Bulgarian legislation or acts of the European Union in certain areas, including, but not limited to, public procurement, financial services, prevention of money laundering and terrorist financing, safety and radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, protection of the inviolability of private
Whistleblowing shall also include: infringements affecting the financial interests of the European Union and infringements of internal market rules, including European Union rules and Bulgarian competition and state aid legislation; infringements relating to cross-border tax schemes, the purpose of which is to obtain a tax advantage contrary to the object or purpose of the applicable corporate tax law; an offence of a general nature of which the whistleblower has become aware in the
Who can report?
A whistleblower for the purposes of the PIPEDA should be a natural person who reports or publicly discloses information about a violation that falls within the category listed above.
What is the procedure and method for filing a whistleblower report under the HIPAA?
In view of the possibility to quickly prevent a violation or to remedy the consequences of a violation falling under the scope of the HIPCPA, the whistleblowing should be prioritized through the internal whistleblowing channel established at the CPC, in particular:
- electronically
- by sending a pre-filled form approved by the Commission for Personal Data Protection (CPDP) to the following e-mail address: signalzzipspoin@kzd.bg. You can download the form here. A signature, electronic signature or other identification of the sender shall be affixed to the completed form.
- verbal submission of a signal - by phone 02/807 30 47 (phone calls are not recorded) or on site at the building of the CPD with address. In the office of the CPD, at the address of the CPD. “Dragan Tsankov” № 35, with a request for a meeting with the designated person responsible for the examination of signals.
- whistleblowers or persons making public information about violations may choose how to report
- to raise a whistleblowing concern through the internal whistleblowing channel mentioned above, by publicly disclosing information about the breach and/or by submitting the whistleblowing concern to the Central External Whistleblowing Body
- Commission for Personal Data Protection, Sofia Sofia, bul. "Prof. Tsvetan Lazarov" № 2, email: kzld@cpdp.bg.
More information on the procedure and how to submit a report to the Commission for Personal Data Protection in relation to the PIPEDA can be found on its website: https://www.cpdp.bg.
What protection does the law provide for whistleblowers?
The law prohibits any form of retaliation against whistleblowers and other protected persons that is in the nature of reprisal and places them at a disadvantage, as well as threats or attempts to do so. Forms of retaliation include, but are not limited to, dismissal, demotion or delay in promotion, change in location or nature of work, reduction in pay, negative performance evaluation, including in a job recommendation, imposition of discipline, discrimination, early termination of a contract, damage, including to the person's reputation, or financial loss, including loss of business and loss of income, termination of a license or permit. In the event of a breach of this prohibition, the whistleblower shall be entitled to compensation for material and non-material damage suffered. Damage caused to the whistleblower in connection with the whistleblowing or the information made public by the whistleblower shall be deemed to have been caused intentionally until proven otherwise.
Important!
Signals submitted by a natural person, in person or by a proxy with an express written power of attorney (no notarisation required) are considered. In the case of an alert submitted by proxy, the original power of attorney shall be attached to the alert. No proceedings shall be initiated in respect of anonymous reports or reports relating to offences committed more than two years ago. Registered alerts that do not fall within the scope of the HIPAA and whose content does not warrant being considered credible shall not be considered. Within the statutory time limit after registering an alert, the whistleblower shall be provided with information on the registration of the alert and its PIN and date. Any further information or communication regarding the alert shall be applied to this PIN. Any new or unspecified information relating to the whistleblowing may be further provided by the whistleblower. When submitting it, the PIN received for the alert shall be indicated. Registered alerts containing manifestly false or misleading statements of fact shall be returned with instructions to the whistleblower to correct the allegations and to the liability for incrimination under Article 286 of the Penal Code.
According to Article 45 of the HIPAA, fines ranging from 3000 BGN to 7000 BGN are foreseen for bad faith whistleblowers containing false information!
For more information on the rights and obligations of the obliged entities within the meaning of Art. 1 of the HIPCPA and those of whistleblowers, please refer to the Whistleblower Protection Act.
For all other general questions concerning the jurisdiction of the CPD, PLEASE use kzd@kzd.bg