Category: Bulgaria

On 7 October 2019, the European Union adopted a Directive on the protection of persons reporting on breaches of Union law (the “Whistleblowing Directive” or the “Directive”).

The Directive covers both the public and the private sector by setting minimum standards and ensuring a uniform level of protection for whistleblowers reporting breaches of EU law in defined areas. 

Currently, less than half of the EU Member States, including the United Kingdom, France, the Netherlands, Hungary, Italy, and others, have comprehensive whistleblower protection legislation. In the remaining countries, there is legislation in only a limited number of sectors (mostly in the areas of financial services), which include measures to protect whistleblowers.

A 2017 study carried out for the Commission estimated the loss of potential benefits due to a lack of whistleblower protection, in public procurement alone, to be in the range of EUR 5.8 to EUR 9.6 billion each year for the EU as a whole.

Who falls within the protection?

In general, persons protected include those who could acquire information on breaches in a work-related context, e.g. employees and civil servants at national/local level. The Directive goes even beyond by providing protection also to individuals outside the traditional employee-employer relationship, such as consultants, contractors, volunteers, shareholders/board members, former workers and job applicants. It also protects individuals who assist whistleblowers, as well as individuals and legal entities connected with whistleblowers.

The main elements of the protection include:

• A wide scope of application: the new rules will cover areas such as public procurement, financial services, prevention of money laundering, product and transport safety, nuclear safety, public health, consumer and data protection, etc. For legal certainty, a list of all EU legislative instruments covered is included in an annex to the Directive. Member States may go beyond this list when implementing the new rules. 

• Support and protection measures for whistleblowers: the rules introduce safeguards to protect whistleblowers from retaliation, such as being suspended, demoted and intimidated. These persons are protected from dismissal, degradation and other discrimination. Whistleblowers cannot be held liable for breaching restrictions on the acquisition or disclosure of information, including for breaches of trade or other secrets. In addition, the possibility of contracting out of the right to blow the whistle, through, for example, loyalty clauses or confidentiality or non-disclosure agreements, is excluded.

• Protection of whistleblowers’ identity: the Directive protects the identity of whistleblowers in most circumstances. It grants protection to whistleblowers who have reported or disclosed information anonymously and who have subsequently been identified.

• Provision of hierarchized reporting channels: whistleblowers are encouraged to use internal channels within their organisation first, before turning to external channels which public authorities are obliged to set up. In any event, whistleblowers will not lose their protection if they decide to use external channels in the first place. In granting protection, the new rules do not in any way take into account the whistleblowers’ motive for reporting. Whistleblowers should be able to submit reports either in writing via an online system, a mailbox, by post,or orally via a telephone hotline or answering machine system. Companies are also obliged to offer a personal meeting should the whistleblower request it. 

What shall the companies/administration envisage?

The EU Directive requires companies/administration to be compliant with the law, by the following measures:

• Creation of channels of reporting within companies/administrations: there is an obligation to create effective and efficient reporting channels in companies of over 50 employees (or more than EUR 10 million in annual turnover) or municipalities of more than 10 000 inhabitants. Companies with 250 or more employees will be expected to comply within two years of adoption, companies with between 50 and 250 employees have additional two years after transposition to comply.

• Feedback obligations for authorities and companies: the rules create an obligation to respond and follow-up to the whistleblowers’ reports within 3 months (with the possibility of extending this to 6 months for external channels in duly justified cases). Companies must determine the “most suitable” person to receive and follow up on reports internally, e.g. compliance officer, head of HR, legal counsel, etc. 

• Provision of information on the internal reporting process as well as on the reporting channel(s) to the competent authority. This information must be easily understandable and accessible, not only to employees, but also to suppliers, service providers and business partners.

• General measure for compliance with the GDPR: the companies/administration shall make sure that the system also complies with current data protection regulations such as GDPR.

Sanctions

The Directive provides for penalties to be applied to persons who hinder or attempt to hinder reporting, retaliate against reporting persons and breach the duty of maintaining the confidentiality of the whistleblowers’ identity. It is the job of national legislators to determine the severity of these sanctions.

The next steps

Following the formal adoption of the Directive by the EU Council on 7 October 2019, a two-year implementation period begins during which time the EU Member States will be obliged to implement the Directive into their own national laws. Member States should transpose those provisions in line with the spirit of the Directive, which is to provide a high level of protection for whistleblowers. However, companies are advised not to wait until the last minute and to take action at an early stage.

By Desislava Anastasova, Associate, CMS Sofia

There were more than 2.7 million vehicles in Bulgaria in 2018, 319,639 of which were newly registered. Yet it appears that such figures, even in a country with a population of less than seven million, don’t necessarily create an opportunity for the development of connected car services. Why aren’t connected cars more significant and widely-used in Bulgaria?

Stakeholders in the Bulgarian connected car ecosystem (including car manufacturers, mobile network providers, connected car and fleet management services providers, and car owners) generally encounter a vehicle fleet dominated by cars at least five years old and legislation dealing with “classic” connectivity services such as Internet access and fixed/mobile voice services or SIM cards managed as physical assets (i.e., physically provided and manually plugged in). Despite the fact that Bulgarian legislation lags behind the latest technological developments, it is potentially flexible enough to embrace any service providing for connectivity as an underlining feature as a “telecom service.” 

“Connected” cars are vehicles that use connectivity (i.e., a conveyance of signals) in order to provide navigation, phone integration, remote services (lock, horn, tracking stolen vehicle), remote diagnostics and maintenance alerts, and entertainment services. Thus, the connectivity (usually based on a pre-installed SIM) is a core part of connected car services. The Bulgarian Electronic Communications Act, however, is based on the legal concepts of the 2002 European telecoms regulatory framework (which hasn’t undergone any major amendments since 2009) and which defines an electronic communications service (ECS) as one that involves “wholly or mainly” the “conveyance of signals” without providing any details how “mainly” should be interpreted. In order to avoid the burdensome telecommunications regulations, car manufacturers (or connected car/fleet management services providers) should therefore either avoid providing connectivity or develop the service so that it avoids being qualified as involving “mainly” conveyance of signals. The first approach seems unrealistic, as, due to the existence of region-specific regulations (such as eCall under EU law) car manufactures, for example, already use connectivity solutions embedded in cars. Indeed, manufacturers don’t provide the connectivity themselves and count on third parties.

Fortunately, however, there is room for doubt as to whether connectivity is the “main” part of the service. Indeed, if the Bulgarian regulator (the Communications Regulation Commission, or CRC) chooses to assess the service based on whether, from a functional point of view, it includes the conveyance of signals, there is a huge potential to claim that the connected car service is an ECS. This claim could be supported by the fact that connected car services may be based on machine to machine (M2M) connectivity and that such services under Bulgarian law should qualify as an ECS. This is because the statutory definition of M2M services is based on data transfer, and data transfer services are explicitly included in the “List of the networks and services by virtue of which electronic communications services under general rules shall be provided.” Yet the connected car service rarely represents pure connectivity; instead, it’s a complex service dealing with telemetric, telematic, entertainment, and other services focusing primarily on the content and experience, rather than on the connectivity itself. Given such purely theoretical reasoning, it’s feasible to claim that under Bulgarian law connected car services should not be subject to ECS regulation. 

Unfortunately, the CRC is committed to a case-by-case assessment approach, which – due to the lack of publicly available information related to such assessments –  doesn’t help the stakeholders. Both legal practitioners and connected car service stakeholders know that using guidelines is a rare practice in Bulgaria, as guidelines aren’t statutorily binding and thus don’t contribute to legal certainty. This is unfortunate, as all players would benefit from knowing the official position of the regulator. In fact, the CRC has a new and unprecedented opportunity to issue clear guidance, as the upcoming transposition of the European Electronic Communications Code in Bulgaria provides a chance to clarify the legal nature of connected cars as well as other digital services. Any official position (regardless whether through a statutory instrument or a public statement) will be more than welcome. Its absence leaves space for factional regulatory compliance.

By Violetta Kunze, Partner, and Milka Ivanova, Senior Associate, Djingov, Gouginski, Kyutchukov & Velichkov

This Article was originally published in Issue 6.8 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.