With regard to questions received by the CPDP that are related to the application of the newly adopted Act on Protection of Persons, Reporting Information, or Publicly Disclosing Information about Breaches and taking into account its high public importance, the CPDP informs that:
1. Pursuant to § 10 of its Final Provisions, the Act shall enter into force three months after its promulgation in the State Gazette (i.e. from 4 May 2023), as Chapter II, Section I (Internal Reporting or etc. so-called Internal Channel) with Articles 12 – 18 will apply to private sector employers who have between 50 and 249 workers or employees, from 17 December 2023.
2. From 4 May 2023, employers from the public and private sectors who are obliged subjects under Article 12, paragraph 1 of the APPRIPDIB (with the exception of employers in the private sector who have between 50 and 249 workers or employees, see item 1) have an obligation to ensure the possibility of internal reporting within the meaning of the Act. For this purpose, on 4 May 2023, a functionality for generating a Unique Identification Number (UIN) will be put into operation on the CPDP website, which will be taken by the employees designated under Article 14 of the Act, who are in charge of handling reports. This number will be used by them for the purposes of registering the reports submitted to the obliged subjects. In order to obtain a UIN, the employee in charge of handling the report will need to provide the following information:
– Name and UIC/BULSTAT of the employer at whom the report has been filed;
– Identification data of the employee in charge of handling the report;
– Subject matter of the report (the relevant areas provided for in Article 3, paragraph 1 and paragraph 2);
– Method of receipt (written or oral);
3. The external information reporting to the CPDP (the so-called “External channel”) will be available after the 6th month from the promulgation of the Act in the State Gazette – i.e. from 4 August 2023.
4. Pursuant to § 9 of the Final Provisions of the Act, until 4 August 2023, the CPDP has the task to adopt:
– The Ordinance on keeping the register of reports and on forwarding internal reports to it;
– The methodological guidelines to the obliged subjects under Article 12, paragraph 1 of the Act;
– Sample of a register of reports; and
– Report reception form.
5. Along with this, the CPDP also publishes a Road map, which outlines the main stages of the implementation of the system for protection of the persons reporting or publicly disclosing information about breaches.
6. In the future, the CPDP will gradually publish on its website any additional information related to the implementation of the APPRIPDIB.
