Frequently asked questions on the Whistelblower Protection Act (PDF)
1. Since when is the APPRIPDIB applied?
The APPRIPDIB shall enter into force on 4 May 2023 and shall be applied from the same date to all obliged subjects, including the subjects under Article 12, paragraph 1, item 3.
An exception is provided only for employers in the private sector that have between 50 and 249 workers or employees, to which the Act shall apply from 17 December 2023.
2. Who and for what breaches may submit a report under the APPRIPDIB?
Only natural persons have the right to submit a report under the APPRIPDIB, who, in relation to the structure/organization to which they submit the report, have one of the following qualities:
1. worker, employee, civil servant or other person who performs wage labour, regardless of the nature of the work, the method of payment and the source of financing;
2. a person who works without an employment relationship and/or exercises a liberal profession and/or craft activity;
3. volunteer or intern;
4. partner, shareholder, sole owner of the capital, member of the management or control body of a commercial company, member of the audit committee of an enterprise;
5. a person who works for a natural or legal person, its subcontractors or suppliers;
6. a job applicant who participated in a competition or other form of selection for employment and in this capacity received information about a violation;
7. worker or an employee, when the information was obtained within the framework of an employment or service relationship, that was terminated at the time of the filing of the report or of the public disclosure;
8. any other whistleblower who reports a breach that has become known to him in a work context.
In order to be handled under the terms and conditions and accoding to the procedure of the APPRIPDIB, the report should contain information about actions or omissions which are:
(а) unlawful and are related to the Bulgarian legislation or the acts of the European Union in the areas specified in Article 3, or
(b) contrary to the subject or purpose of the rules in the acts of the European Union and the areas specified in Article 3,
and which have been committed or are very likely to be committed in this organization, as well as for attempts to cover up wrongdoing.
3. Which report falls within the scope of the APPRIPDIB?
Reports that simultaneously meet the following conditions fall within the scope of the Act:
1. are submitted by a person having any of the qualities under Article 5;
2. a work context is available within the meaning of § 1, item 4 of the Additional Provisions of the Act; and
3. concern acts or omissions which are:
(а) unlawful and are related to the Bulgarian legislation or the acts of the European Union in the areas specified in Article 3 of the Act; or
(b) contrary to the subject matter or purpose of the rules in the acts of the European Union and the areas specified in Article 3 of the Act.
4. Does a report or publicly disclosed information about a violation of an internal rule adopted by the obliged subject fall within the scope of the Act?
The substantive scope of the Act includes reports or publicly disclosed information about violations of Bulgarian legislation or the acts of the European Union, annexed to the Act. However, if a violation of an internal rule adopted by the obliged subject leads to their violation and there is a clear cause-and-effect relationship for this, it falls within the substantive scope of the Act.
5. Is it permissible, as part of the internal whistleblowing process, for the obliged subject to provide for additional reportable matters by making commitments similar to those under the APPRIPDIB? For example, reporting of breaches that are outside the scope of the APPRIPDIB or circumstances that do not constitute violations of the Act, but of internal rules of the obliged subject?
There is no legal obstacle for an employer to introduce the possibility of reporting irregularities or breaches that are outside the scope of the APPRIPDIB. In this case, the employer should take appropriate measures for their clear distinction, respectively the proper informing of employees as to which reports fall under the scope of APPRIPDIB and which do not, as well as the legal consequences for the whistleblower.
6. Do reports concerning intra-organizational and/or intra-administrative breaches committed within the structure of an obliged subject under the same Act fall within the scope of the APPRIPDIB?
If such violations have no connection and do not lead to a violation of Bulgarian legislation or acts of the European Union, which fall within the subject scope of the APPRIPDIB, including they do not threaten or damage the public interest, the latter Act does not apply to them.
7. May conplaints be handled under the terms amd conditions and according to the procedure of the APPRIPDIB?
Only reports or publicly disclosed information about violations of Bulgarian legislation or acts of the European Union, which threaten or damage the public interest, as well as the law of the European Union, fall within the subject scope of the APPRIPDIB (arg. Article 1, paragraph 1 of the APPRIPDIB). This procedure of consideration applies only to reports that fall within the scope of Article 3 of the APPRIPDIB and are submitted under the terms and conditions and according to the procedure of this Act.
The APPRIPDIB is not applicable for handling complaints, reports and other requests, regardless of how they are titled, through which only the protection of personal rights is sought, to which by definition the presence of a personal and direct legal interest is attributed, without any indication of affected public interest. Moreover, according to the procedure aand the terms and conditions of the APPRIPDIB, complaints titled as a whistleblowing report concerning interpersonal relations, regardless of the presence or absence of a work context, may not be handled. A complaint is a legal remedy by which a person seeks protection of own violated rights. In contrast, through the report, protection of the public interest is sought, regardless of whether the personal rights and interests of the whistleblower are also affected.
8. How to distinguish a report submitted according to the general procedure of the APC from a report submitted according to the procedure of the APPRIPDIB?
If an obliged subject from the public sector receives a report submitted according to the general procedure of the APC, it shall be handled according to this procedure.
In the event that in the course of its handling it becomes clear that the report falls within the scope of the APPRIPDIB and has been submitted by a person under Article 5 thereof, such a report shall be forwarded to the employee(s) in charge of handling reports under this Act. The employee in charge of registering the report shall fill in the report form and shall obtain a UIN from the CPDP. In such cases, protection shall be provided for the persons referred to in Article 5, and the handling of the report shall continue according to the procedure of the APPRIPDIB.
In the event that, during the handling of a received report, it is established that it does not fall within the scope of the APPRIPDIB and/or has not been submitted by a person referred to in Article 5 of the Act, the report may not be handled according to the procedure of the APPRIPDIB, respectively no protection is due under this Act.
With a view to facilitating the work of the obliged subjects from the public and private sectors, they should provide the persons referred to in Article 5 of the APPRIPDIB with clear and easily accessible information about the terms and conditions and the procedure of filing reports. The information shall be provided on the websites of the obliged subjects, as well as in a prominent place in the offices and work premises (Article 12, paragraph 4).
9. Who is obliged to build and maintain an internal whistleblowing channel under the APPRIPDIB?
Obliged subjects under this Act, who must build an internal whistleblowing channel, are all employers1 from the public and private sectors, regardless of their legal organizational form, as follows:
From the public sector: all employers who are also obliged organizations from the public sector according to the Financial Management and Control in the Public Sector Act (FMCPS), regardless of the number of workers or employees.
The APPRIPDIB provides for a legal option only for the municipalities under Article 12, paragraph 2 (which are also obliged subjects under this Act) to share/pool resources to create an internal channel.
Financial Management and Control in the Public Sector Act
Article 2. (1) The provisions of this Act shall be applied in the public sector organizations.
(2) In the meaning of this Act, public sector organizations shall refer to::
1. (amended, SG No. 15/2013, effective 01.01.2014, supplemented, SG No. 13/2019 ) budgetary organizations within the meaning of the Public Finance Act, as well as municipal enterprises within the meaning of the Municipal Property Act;
2. (repealed, SG No. 15/2013, effective 01.01.2014);
3 (repealed, SG No. 15/2013, effective 01.01.2014);
4. (repealed, SG No. 15/2013, effective 01.01.2014);
5. organizations spending funds guaranteed by the Republic of Bulgaria;
6. organizations spending funds from European Union funds and programmes;
7. (amended, SG No. 13/2019) state-owned enterprises referred to in Article 62, paragraph 3 of the Commercial Act;
8. (amended, SG No. 13/2019) commercial companies, including medical facilities, with over 50 percent state and/or municipal participation in the capital;
9. (new, SG No. 13/2019) commercial companies the capital of which is wholly owned by the companies under item 8.
Additional Provisions
§ 1. For the purpose of this Act:
1. (amended, SG No. 43/2016) “Public funds” shall mean all funds which are collected, received, kept, allocated and spent by public sector organizations.
From the private sector:
• staff of up to 50 persons: are not obliged subjects to build an internal channel under the APPRIPDIB, unless they carry out an activity that falls within the scope of Article 12, paragraph 1, item 3;
• staff of 50 to 249 persons: all are obliged subjects and may share a resource to create an internal channel (Article 12, paragraph 3);
• staff of over 250 persons: all are obliged subjects, but have no legal option to share a resource to create an internal channel;
• enterprises providing temporary employment with varying staff (below and above 50 workers and employees at a given time): regardless of the varying number of employees, once a number of 50 employees is reached, they become an obliged subject under this Act.
• all employers in the private sector, regardless of the number of employees, if they carry out an activity that falls within the scope of Article 12, paragraph 1, item 3.
All other employers who are not obliged to build and maintain an internal reporting channel, if the relevant prerequisites are present (e.g. a report has been filed against them through the external channel – the CPDP), are obliged to ensure the measures provided for in Chapter III of the Act for protection of the persons referred to in Article 5 thereof. For the purpose of this Act, branch organizations are obliged subjects when they fall under the hypothesis of being employer or, in a broader work context, employing labour, regardless of the nature of the work, the method of payment or the source of funding. Of course, the requirement for the number of employees under Article 12, including in the hypothesis of Article 12, paragraph 1, item 3 of the APPRIPDIB, should be taken into account.
10. Is it permissible to use an internal whistleblowing channel, which has been built before the entry into force of the Act, including such a channel that provides for anonymous submission?
If an internal channel has already been built by an obliged subject under this Act, it may also be used for the purposes of the APPRIPDIB, if it meets the requirements of this Act or is brought into line with it. If such an existing channel also allows the receipt of anonymous reports, such reports may be further submitted for purposes other than the purposes of the APPRIPDIB, being kept in a separate register.
11. Is it permissible for individual companies within an economic group (e.g. parent company and its subsidiaries, holding structure, etc.) to use an existing internal whistleblowing channel or create one within the group to be used by all companies?
There is no legal obstacle within an economic group (e.g. parent company and its subsidiaries, holding structure, etc.) for individual companies to use an existing internal whistleblowing channel (including functions of receiving and registering of reports) or create one channel within the group to be used by all companies. However, it should be noted that the individual companies are independent obliged subjects under Article 12, paragraph 1 of the APPRIPDIB and the fact that they use in common the channel of the economic group does not exempt them from all obligations arising from the APPRIPDIB, including to designate an employee from within their organizational structure to handle the report.
12. If an employer from the private sector which is not required to build and maintain an internal whistleblowing channel under the APPRIPDIB receives a report that falls within the substantive scope of the Act, does such an employer have obligations under the abovementioned Act?
If an employer from the private sector which is not obliged to build and maintain an internal whistleblowing channel receives a report that falls within the substantive scope of the APPRIPDIB under Article 3, it shall forward the report to the CPDP for taking action based on competence. Nevertheless, such an employer is obliged to ensure the measures under Article 31 and Article 33 of the APPRIPDIB for protection of the persons referred to in Article 5 of this Act.
13. Are the second-level and/or third-level budget spending units obliged subjects?
Regardless of the administrative hierarchical subordination between certain structures, their divisions or units (e.g. ministry and executive agency; municipality and municipal enterprises or kindergartens, etc.), decisive for the occurrence of the obligation to build and maintain an internal channel under the APPRIPDIB is the quality of “independent employer” within the meaning of § 1, item 2 of the AP of the APPRIPDIB of the relevant structure, division or unit and the required number of employees, not the hierarchical subordination in the organization, the legal organizational form or who appoints and dismisses its head.
14. Is the professional quality of a natural person or the activity carried out by him/her a prerequisite for the occurrence of obligations under the APPRIPDIB?
The professional quality of a natural person or the activities carried out by him/her (e.g. lawyer, private enforcement agent, notary, doctor, etc.) do not automatically lead to the emergence of an obligation to build and maintain an internal whistleblowing channel under the APPRIPDIB. The obligation arises only if such a person is also an “employer” within the meaning of § 1, item 2 of the AP of the APPRIPDIB. Although not being obliged to build and maintain an internal whistleblowing channel, in the presence of the respective prerequisites (e.g. a report has been filed against them through the external channel – the CPDP), these persons are obliged to ensure the measures provided for in Chapter III of the Act for protection of the persons referred to in Article 5 thereof.
15. Who may receive and register a report under the APPRIPDIB?
Receiving a report:
• written report – may be carried out by an employee of the obliged subject or by a natural or legal person external to its structure (with the exception of employers in the public sector, pursuant to Article 14, paragraph 5)
• oral report –only by an employee/s in the structure of the obliged subject (Article 15, paragraph 3)
Registering a report:
• written report –may be carried out by an employee of the obliged subject or by a natural or legal person external to its structure (with the exception of employers in the public sector, pursuant to Article 14, paragraph 5) by filling in and registering the form, approved according to the sample of the CPDP
• oral report – only by an employee/s in the structure of the obliged subject (Article 15, paragraph 3)
16. Is it permissible for an obliged subject under Article 12 to assign the functions of receiving and registering reports to a foreign legal or natural person?
There is no legal obstacle to assigning the functions of receiving and registering reports to a foreign legal or natural person, provided that this does not lead to non-fulfillment of obligations under the APPRIPDIB, under the Ordinance under Article 19, paragraph 2, item 3 of the APPRIPDIB, under the methodological guidelines of the CPDP to the obliged subjects under Article 12, paragraph 1 and does not prevent the exercise of the control powers of the CPDP, including the possibility for pursuing administrative criminal liability under this Act.
17. Is it mandatory for the employee in charge of receiving and registering the report (and the whistleblowers) to use the form approved by the CPDP for submitting and registering reports?
The form approved by the CPDP is mandatory for the employee in charge of receiving and registering the report. The form is not mandatory for whistleblowers – however, they may use it if they wish or if they find that it makes it easier for them to submit the report.
If a whistleblower submits a report in a form other than the form approved by the CPDP, the employee in charge of receiving and registering the report must enter the information from the report in the approved form.
18. What is it for and how is the UIN obtained?
The main purpose of the UIN, which is given by the CPDP, is to obtain the individualization and traceability of each report (Article 19, paragraph 2, item 2 in conjunction with items 4 and 5 and Article 2), as well as to ensure connectivity (accountability and control) between the registers (Article 29, paragraph 1). The UIN is a requisite of the sample form for registering a report, which is approved by the CPDP. The report itself and the materials related to it, including the form for its registration (according to the sample approved by the CPDP), when submitted through the internal channel to the obliged subjects, are not submitted to the CPDP.
Before taking any action to obtain a UIN, the employee in charge of receiving and registering reports under the APPRIPDIB should, if necessary, seek assistance from the employee(s) in charge of handling reports under this Act, upon the initial formal review of whether the report falls within the scope of the APPRIPDIB (see question 3, in particular item 3).
To obtain a UIN, the person who registers the report shall provide only the following data:
– Name and UIC/BULSTAT of the employer at which the report has been submitted;
– Identification data of the employee in charge of handling the report;
– Subject matter of the report (the relevant areas provided for in Article 3, paragraph 1 and paragraph 2);
– Method of receiving the report (written or oral).
This information shall be used for the CPDP’s control, administrative-penal and statistical purposes. The obliged subject shall record the information about the obtained UIN in the register under Article 18, paragraph 2, kept by it.
19. Is it necessary for the employee in charge of registering the report through the internal channel to send it to the CPDP in order to obtain a UIN?
No. In order to obtain a UIN, the employee who registers the report shall provide only the information specified in the answer to question 18.
20. Within what period is a UIN obtained and shall it be obtained for each report?
A UIN is obtained immediately after receiving a report that has been submitted within the business hours of the obliged subject. For reports received after the end of the business hours of the of the obliged subject, the UIN shall be obtained on the first business day following the receipt of the report.
All reported breaches that fall within the scope of Article 3 of the APPRIPDIB shall be registered with a UIN, including:
• reports relating to violations committed more than two years before (Article 9, item 2);
• reports of violations, the content of which does not provide any grounds to be considered credible (Article 15, paragraph 6, proposition 2); reports containing obviously false or misleading statements of fact (Article 15, paragraph 6, proposition 3);
• reports of violations subject to reporting under special regulations;
• reports of violations that have already been found by an internal unit of the obliged subject (e.g. internal audit or inspectorate), regardless of whether actions have been taken to remedy them;
The persons who have anonymously filed a report not in compliance with the procedure of the APPRIPDIB or publicly, but anonymously, have disclosed information about violations, and have subsequently been identified and have become the subject of repressive retaliatory actions, are entitled to protection, when the conditions set out in Article 6, paragraph 1 and Article 7 of this Act are present. In such cases, the employee in charge of handling reports shall fill in a report registration form, generate a UIN and enter it into the form, filing the report so disclosed or the information publicly disclosed with an own incoming number from the document flow information system or with another identifier containing a serial number and date of submission of the anonymous report/date of public disclosure of information about breaches.
Reports in respect of which it is obvious from the initial review that they concern a complaint (complaints or reports) about irregularities or dissatisfaction of customers/users of the relevant professional or administrative services of the obliged subject shall not be registered with a UIN.
The above information shall be used for control and statistical purposes of the CPDP. The obliged subject shall record the information about the obtained UIN in the register under Article 18, paragraph 2, kept by it.
21. Should an obliged subject under the Act, which, within its usual activity, receives reports of irregularities or dissatisfaction with the service from its customers – consumers (e.g. a company providing water and sanitation services), register these reports in accordance with the procedure of the APPRIPDIB?
No. These reports do not fall within the scope of the APPRIPDIB.
22. Is the sample of the Register of Reports approved by the CPDP mandatory or may the obliged subjects use their own format of this register? Is the register used by the obliged subjects subject to control by the CPDP?
The requisites of the Register of Reports, which the obliged subjects must create and maintain, are defined exhaustively in Article 18, paragraph 2 of the APPRIPDIB. The procedure of its keeping is determined by an act of the obliged subject, in fulfilment of the requirements of the ordinance referred to in Article 19, paragraph 2, item 3, proposition 3 of the APPRIPDIB, which the CPDP should adopt until 4 August 2023.
The sample of the Register of Reports approved by the CPDP aims to assist the obliged subjects in the fulfilment of their obligation to create and maintain it (§ 9 of the FP of the APPRIPDIB).
There is no obstacle for the obliged subjects to use their own format of the Register of Reports as long as it complies with the regulatory requirements for its content and the procedure of its keeping.
Pursuant to § 7 of the FP of the APPRIPDIB the CPDP provides guidelines on the application of the Act for all obliged subjects and controls their implementation of its provisions. Therefore, the obligation to create and maintain the register is subject to control by the CPDP.
23. Who can handle a report under the APPRIPDIB?
A report can only be handled by an employee/s in the obliged subject’s structure. A conclusion cah be drawn from the division of the functions under Article 14, paragraph 5 in conjunction with Article 16 that this is a function that is assigned by the Act only to an employee from the structure of obliged subject. However, this does not limit the possibility for him/her to be assisted by another natural or legal person outside the structure of obliged subject, including when an external service for receiving and registering reports is not used. In this case, however, such assistance should not lead to violations of the obligations of the obliged subject under the Act.
24. Who can be designated as an employee in charge of handling reports under the APPRIPDIB?
According to recital (56) of Directive 2019/1937, the choice of the most appropriate persons or departments in the framework of a legal subject in the private sector that should be designated as competent to receive reports and take follow-up actions depends on the structure of the subject, but in any case their function should be such as to guarantee independence and absence of conflict of interest. In smaller subjects, this function may be combined with other functions, being performed by a company employee who is in a good position to report about whistleblowing directly to the head of the organization, such as a director of compliance or a director of human resources, an integrity employee, lawyer or data protection officer, chief financial director, audit executive director or member of the managing board.
This does not exclude the option that situations of conflict of interest may arise with respect to these employees. For each specific case, an assessment of the presence or absence of such conflict should be made. It is recommended that each obliged subject establish in advance an internal organization for receiving, registering and handling reports in such cases (e.g., designating a reserve employee/s or creating a specialized unit of employees to handle reports under the APPRIPDIB).
A subsidiary established in Bulgaria, as an independent obliged subject under the Act, should designate its own employee/unit for handling reports. Obliged subjects only from the private sector may assign the functions solely of receiving and registering reports of breaches to another natural or legal person outside their structure, subject to compliance with the requirements of this Act. There is no obstacle to using the good practices and experience of the parent company, only if they do not contradict the APPRIPDIB.
25. May more than one person perform functions of handling reports within the structure of one obliged subject?
According to Article 14, paragraph 1 of the APPRIPDIB obliged subjects may designate one or more employees to be in charge of handling reports of breaches. It is permissible for these employees to be set in one unit or to be employees from different structural units of the obliged subject. There is no obstacle for each of these employees to perform functions of handling reports in a particular subject area according to his/her expertise, or for one employee to perform these functions, with all others assisting him/her in the whistleblowing activity. For the purpose of holding them accountable and liable under the APPRIPDIB, it is appropriate for the persons in question to be designated in advance by name in a special act of the obliged subject. It is the obliged subject that makes the assessment of the specific organization of the activity of the employees in charge of handling reports and it should not lead to violations of the obligations under the APPRIPDIB or the right to protection of the persons referred to in Article 5 of the Act.
26. May the employee in charge of handling reports in the parent company abroad handle reports filed in a subsidiary which is based in Bulgaria?
If a subsidiary which is based in Bulgaria has the status of “employer” within the meaning of § 1, item 2 of the AP of the APPRIPDIB, it is an independent obliged subject under the Act and should designate its own employee/unit for handling reports. Obliged subjects only from the private sector may assign the the functions solely of receiving and registering reports of breaches to another natural or legal person outside their structure, subject to compliance with the requirements of this Act. In such cases, the employee in charge of handling the report should guarantee the rights of the whistleblower and the observance of the obliged subject’s obligations, regardless of the chosen technical and organizational means for their fulfilment (including the language of communication).
27. How should the employee in charge of handling reports through the internal channel proceed upon the receipt of a report against the whistleblower’s employer – should he/she conduct an internal verification of the report or should he/she forward it to the CPDP for consideration?
Such a report should be verified internally by the employee in charge of handling reports and in case the facts presented in the report are confirmed, the employee should direct the whistleblower to submit simultaneously a report to the CPDP. The employee in charge of handling the report has no obligation to forward the report to the CPDP, he/she is only obliged to advise the whistleblower of the legal possibility for the whistleblower to submit the report to the CPDP as well. The act of directing the whistleblower should be duly documented by the employee in charge of handling reports, in view of the need to prove compliance with his/her obligation (arg. Article 16, item 11 (d), proposition 2 of the APPRIPDIB).
28. May an obliged subject from the public sector which has an external data protection officer assign to the same officer the functions of an employee in charge of the receiving, registering and handling reports under the APPRIPDIB?
No. Pursuant to Article 14, paragraph 5 of the Act, only the obliged persons from the private sector have the legal possibility to assign the functions of receiving and registering reports of breaches to another natural or legal person outside their structure. The consideration of the report may not be assigned to a person outside the obliged subject’s structure either. However, this does not limit the possibility for the obliged subject to be assisted by another natural or legal person outside its structure by means of consultations.
29. Should the obliged subject notify the CPDP of the designated employee(s) in charge of handling reports under the APPRIPDIB?
No. The obliged subject does not have a legal obligation to inform the CPDP about the designated employee(s) in charge of handling reports under the APPRIPDIB, including in the cases of assigning these functions to a natural or legal person external to the structure of the obliged subject, as well as in case of a change of these employees. Such information shall be provided only at the express request of the CPDP for the purposes of its control under the APPRIPDIB.
30. What is the storage period for the reports and the materials attached to them, including the follow-up documentation related to their consideration?
The storage period will be subject to the ordinance under Article 19, paragraph 2, item 3, item 3 of the APPRIPDIB. Pursuant to § 9 of its Final Provisions, the CPDP should adopt it until 4 August 2023. When assessing the statutory regulation of the period of storage of the reports and the materials attached to them, the CPDP will take account of the two-year preclusion period under Article 9, item 2 of the APPRIPDIB and after the expiration of the said period, the report shall not be considered and shall be inadmissible; the expiration of the limitation period for prosecution of the crime of false accusation under Article 286 of the Criminal Code; other legally established time lmits, including those that relate to the possibility of instituting criminal, civil and administrative proceedings in relation to the submitted report and the actions taken with regard to it.
31. Should every report received through an internal channel be forwarded to the CPDP?
No, the employee(s) in charge of handling reports should not forward to the CPDP every report submitted through an internal channel that they have received. If an employer from the private sector, which is not obliged to build and maintain an internal reporting channel, receives a report that falls within the substantive scope of the APPRIPDIB under Article 3, they shall forward the report to the CPDP for taking action on the basis of competence. Nevertheless, such an employer is obliged to ensure the measures under Article 31 and Article 33 of the APPRIPDIB for protection of the persons referred to in Article 5 of the same Act.
The procedure and the terms and conditions for forwarding such reports are subject to regulation in the ordinance under Article 19, paragraph 2, item 3 of the APPRIPDIB, which the CPDP should adopt until 4 August 2023.
32. What should an obliged subject under Article 12 do, having received a report through its internal channel, the review of which has shown that it is related to the activity of another obliged subject?
If, after receiving and registering the report with a UIN, the employee in charge of handling reports in the structure of the obliged subject at which the report has been initially received, finds that the report concerns the activity of another obliged subject, this emoloyee shall forward the report by competence to the internal channel of the other obliged subject, of which the whistleblower shall be notified. In this case, the report shall be forwarded in its entirety, including with the obtained UIN, and the forwarding shall be noted in the register under Article 18, paragraph 1. Upon receipt of the forwarded report, the respective employee in charge of receiving and registering reports shall register the report in the register under Article 18, paragraph 1 under the same UIN and shall mark the forwarding.
33. How shall a competent authority under Article 20 of the APPRIPDIB act, when it receives a report?
The competent authorities have a dual quality: an obliged subject under Article 12, which is obliged to build and maintain an internal channel according to the APPRIPDIB and a competent authority, which, within its competence under the relevant special law, is authorized under Article 20 to carry out a verification of a report within the scope of the APPRIPDIB.
Where an authority under Article 20 of the APPRIPDIB receives a report through its internal channel as an obliged subject under Article 12 of the Act, it shall undertake the following:
1. Make an initial formal review of whether the report falls within the scope of the APPRIPDIB (see question 3, in particular item 3).
2. If the assessment under item 1 shows that the report falls within the scope of Article 3 of the APPRIPDIB, it shall take action to obtain a UIN for the report and shall register the report in the register under Article 18 of the APPRIPDIB.
3. After carrying out the actions under item 2, the employee/employees in charge of handling reports shall make an assessment whether the report has been submitted to them in their capacity as an obliged subject under Article 12 of the APPRIPDIB (as an employer in a work context in a broad sense for the whistleblower – see § 1 of the AP of the APPRIPDIB, item 2 and item 4 and Article 5) or in their capacity as a competent authority pursuant to Article 20 of the APPRIPDIB (as an authority competent to handle reports of breaches falling within the scope of the APPRIPDIB).
4. When the analysis under item 2 shows that the report has been filed in the hypothesis of an obliged subject (as an employer in a work context), the employee/s in charge of handling the reports shall perform the actions under Article 15 et seq. of the APPRIPDIB. In this case, the report shall not be forwarded to the CPDP, except in the case of Article 16, item 11 (d) of the APPRIPDIB. The procedure and the terms and conditions for forwarding reports in this case shall be subject to regulation in the ordinance under Article 19, paragraph 2, item 3 of the APPRIPDIB, which the CPDP should adopt until 4 August 2023.
5. When the analysis under item 3 shows that the report has been filed in the hypothesis of a competent authority, the relevant head of the authority under Article 20 is obliged to forward immediately the report to the CPDP. In this hypothesis, it is inadmissible for the competent authority to launch verification of the report on the merits. Only in the hypothesis of Article 28, paragraph 3, the relevant authority shall carry out verification of the report on the merits.
34. Is there a time limit for the protection under the APPRIPDIB?
Neither Directive (EU) 2019/1937 nor the Act introduce a time limit for ensuring protection of the persons in respect of whom it is applied.
35. Is there a maximum and minimum amount of compensation that can be claimed by the whistleblower for pecuniary and/or non-pecuniary damages suffered by him/her as a result of filing a report under the APPRIPDIB?
Pursuant to Article 34 of the APPRIPDIB, the whistleblower is entitled to compensation for pecuniary and non-pecuniary damages suffered by him/her, in the event that a violation of the ban on repressive retaliatory actions under Article 33 of the said Act is found. If the damages that occurred is related to the submitted report, they shall be considered to have been caused intentionally until the contrary is proven (Article 37 of the APPRIPDIB). The Act sets neither a lower nor an upper threshold for the amount of compensation.
As the central authority for external whistleblowing under the APPRIPDIB, the CPDP has no authority to determine and award compensation for pecuniary and/or non-pecuniary damages suffered by the whistleblower in relation to the whistleblower’s report. Only the court to which the whistleblower may refer a claim for compensation pursuant to the general procedure of claims has such a power.
36. May protective measures under the APPRIPDIB impede the fulfilment of legal obligations and/or powers of the law enforcement authorities?
The application of the protection measures under the APPRIPDIB may not result in hindering the fulfilment of legal obligations and/or powers of the law enforcement authorities. The provision of protection and the prohibition on the imposition of repressive retaliatory actions are binding only on the employer against whom a report has been filed under the terms and conditions and according to the procedure of the APPRIPDIB.
______
1 “Employer”, according to §1, item 2 of the Additional Provisions of the APPRIPDIB, is any natural person, legal person or its division, as well as any other organizational and economically separate entity (enterprise, department, organization, cooperative, farm, establishment, household, company and the like), that independently hires workers or employees pursuant to labour and service legal relationship, including for home work and remote work and for sending work for performing in a user enterprise.
The purpose of this information material is to provide clarifications on fundamental issues regarding the application of the Act on Protection of Persons, Reporting Information, or Publicly Disclosing Information about Breaches. It is not intended to be exhaustive. Taking into account the development of the practice of the application of the Act, the CPDP will update and supplement the information material in a timely manner.
Last update: 8 August 2023
