1. Broader scope of entities subject to risk management and reporting obligations under the Cybersecurity Act

The bill introduces definitions of significant and important entities which broadens the scope of the businesses subject to cybersecurity compliance.

Significant entities:

• Entities exceeding the thresholds for medium-sized enterprises which operate in the energy, transport, banking, financial markets infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT management services and aerospace.
• Providers of qualified authentication services, domain name registries, and DNS services regardless of the size of the business.
• Providers of public electronic communications networks or services that qualify as medium-size enterprises.
• All entities conducting certain types of activities in the field of energy, transport, banking, financial markets infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT management services and other fields indicated in the NIS2.
• Entities been determined as essential entities based on the following criteria:

1. act as a sole provider of a service that is essential for the maintenance of critical social and economic activities;
2. a disturbance (for a specified time) in the service provided by the entity could have a significant impact on public security or public health;
3. an interference with the service provided by the entity could cause significant systemic risk, in particular for sectors where such a disturbance could have cross-border impact;
4. the entity is critical because of its specific importance at a national or regional level for the specific sector or type of service or for other interdependent sectors in Bulgaria.

• Entities qualifying as critical based on the assessment to be made by the Bulgarian authorities within 8 months after the implementation of the amendments in the Cybersecurity Act;
• Entities designated as operators of essential services under the existing rules.

» The recruitment process is not formalized, so the employer generally has discretion in determining the recruitment criteria and the required documents, if there are no prohibited discriminative requirements.

» There are some specific data protection rules for recruitment, such as certain limitations on the period of processing of job candidate’s data.

» An important change is the requirement to define the exact address of the remote workplace. This is already the case in practice, also in line with the authorities’ guidelines. The parties have the flexibility to agree on more than one remote workplace. Employees can also temporarily change their remote workplace for up to 30 working days per year.

» Some workplace health and safety obligations are now imposed on employees who work remotely. They must provide written information about the features of their remote place of work in response to the minimum health and safety requirements shared by the employer and report any labour accidents promptly. This may allow for the limitation of the employers’ liability in case of work-related accidents, where remote employees have acted with gross negligence or failed to adhere to the prescribed health and safety requirements.

» There are new set of rules regulating the use of automated systems for the reporting of working time for remote workers. Upon request, employers are required to provide employees with access to their own time and attendance data. Additional information rights are given to employees when such systems are used by the employer.

» All employees are now specifically authorised by law to not respond to messages and calls initiated by their employers outside working hours. Exceptions to this rule can be agreed in the employment agreement or collective bargaining agreement.

» Gas stations are publicly accessible areas and unlimited number of different categories of data subjects will be affected but not only employees of the company (customers, visitors, incl. children).

» Article 107f (107и), para. 3, item 7 of the Labour Code allows employers to introduce monitoring systems (if necessary) subject to obtaining written consents of the concerned employees. According to the data protection watchdog, the expression “if necessary” implies that the employers’ objectives cannot be achieved by other means which is not the case at hand.

» Necessity to comply with the data minimization principle. The use of video surveillance for the purpose of monitoring how employees perform their work duties should be avoided, except in limited cases – when explicitly required by law or where high-risk production activities are performed (e.g., in pharmaceutical, chemical and nuclear power industries).

» Such video surveillance activities constitute a form of further processing of personal data and the criteria of Article 6, para. 4 of the GDPR for compatibility between the initial and the subsequent purpose are not in place, and at the same time it is not possible to obtain valid consent from the employees for such processing.

Emil Lukaev has advised an international outsourcing company on the lease of office premises located in class A office building with 46,000 sq.m. of total office space with landmark design and unique visibility. The office is strategic for client’s vision for the development of its business in Bulgaria and will be used for key operations in addition to the office which is set up in Plovdiv.

This expansion reflects the company’s values and continued dedication to meeting the needs of its clients and marks the broadening of their multilingual offering from Bulgaria.

The work involved due diligence of the leased premises and the office building, negotiating the terms and conditions of the transaction, drafting the lease agreement and the supporting documents and its registration with the Real Estate Register.

» Any person can accept to be a guarantor for another person’s obligation both on his own initiative and on the initiative of the debtor or the creditor.

» Regardless of whose initiative the person gives consent to be a guarantor, the parties to the surety agreement are the creditor and the guarantor.

» The surety agreement must be concluded in writing.

» The written form will be observed both in cases where the contract is concluded by means of a separate document or when it is incorporated into another document (e.g., credit facility agreement).

» The written form of the surety agreement helps parties to substantiate the specific contractual arrangements in case of a dispute.

» The surety agreement shall contain stipulations on determining the obligation which will be assumed by the guarantor, explicit consent that the guarantor shall assume the obligation of the debtor and description of the exact range of the guarantor’s responsibility under the main contract between the debtor and the creditor.