By TI Bulgaria
The case of Portuguese whistleblower Rui Pinto has brought renewed attention to a fundamental question in Europe: what happens when the consequences of exposing wrongdoing continue long after the original disclosures?
In September 2026, Portuguese authorities decided to terminate the special security programme protecting Pinto, who exposed wrongdoing through the Football Leaks revelations.
On 9 October, the Portuguese Commission for Special Security Programmes annulled that decision on procedural grounds, finding that he had not been properly informed of the reasons for ending his protection or given an opportunity to respond. His protection remains in force pending a new decision. The case highlights the importance of procedural safeguards when authorities make decisions that directly affect the protection of individuals who expose wrongdoing.
Protection is more than a legal guarantee
The EU Whistleblower Protection Directive (EU) 2019/1937 establishes minimum standards for protecting individuals who report breaches of EU law in specified areas. It requires Member States to prohibit retaliation, establish confidential reporting channels and ensure access to support measures and effective remedies.
However, protection against workplace retaliation and physical security measures are not necessarily the same. Witness-protection programmes, such as the one applied in Pinto’s case, operate under separate national legal frameworks and involve different eligibility criteria and security assessments.
The Directive does not establish an unconditional right to indefinite physical protection. Nevertheless, the case highlights a broader principle: protection must be effective in practice, and decisions to withdraw it should be based on properly assessed risks and fair procedures.
When does the responsibility of the state end?
Whistleblowers may face threats, professional exclusion, financial hardship and prolonged legal proceedings long after their original disclosures. The consequences of exposing wrongdoing do not necessarily disappear when investigations conclude or public attention fades.
The Rui Pinto case illustrates why decisions to terminate protective measures require particular care. Authorities must balance the legitimate need to periodically reassess security arrangements with their responsibility to prevent foreseeable harm.
Effective procedures should include individualised risk assessments, clear communication of the reasons for decisions, opportunities to challenge adverse findings and, where necessary, transitional protection while decisions are reviewed.
The Portuguese authorities’ decision to annul the initial termination demonstrates the importance of these safeguards. At the same time, the final outcome remains uncertain, as a new assessment and decision are still pending.
A broader European challenge
Across Europe, the implementation of whistleblower protection legislation increasingly raises questions about the gap between formal legal guarantees and their practical effectiveness. Establishing reporting channels and prohibiting retaliation are essential, but they do not automatically ensure that individuals who speak up receive adequate protection when risks persist.
For Bulgaria, this debate is particularly relevant to the implementation of national whistleblower protection legislation, the effectiveness of institutional responses and access to meaningful remedies.
For Bulgaria, this debate is particularly relevant to the implementation of national whistleblower protection legislation, the effectiveness of institutional responses and access to meaningful remedies. Beyond the legal framework, a deeper challenge is the lack of trust in the system and the organisational culture surrounding the reporting of wrongdoing. Where employees believe that reports will be ignored, that those responsible will face no consequences or that speaking up could expose them to retaliation, silence may appear safer than reporting. Research on attitudes towards whistleblowing in Bulgarian municipalities has documented scepticism about the effectiveness of reporting mechanisms, limited trust in organisational leadership and concerns that reports may be suppressed or disregarded.
This challenge is compounded by insufficient awareness among employees of their rights, the available reporting channels and the protection they are entitled to receive. Establishing an internal reporting procedure does not guarantee that staff know it exists, understand how to use it or trust that their confidentiality will be respected. The findings of the Ombudsman’s 2025 audit of the Commission for Personal Data Protection also identified practical weaknesses in the provision of support and the application of safeguards, including uncertainty about available assistance and delays in handling reports.
Changing this situation requires more than legislative compliance. Public institutions and private organisations need to communicate reporting procedures clearly, provide regular practical training and demonstrate that reports are handled confidentially, impartially and seriously. Building a culture in which employees can raise concerns without fear—and see that wrongdoing is addressed—is essential to restoring trust and making whistleblower protection effective in practice.
The case also points to the need for clearer coordination between whistleblower protection mechanisms, law-enforcement authorities and other institutions responsible for personal security.
Whistleblower protection should not be measured only by the safeguards available when a report is submitted, but also by whether individuals remain adequately protected when the consequences of speaking up continue.
Protecting those who expose wrongdoing is not merely a question of individual safety. It is also a measure of institutional accountability, public trust and the credibility of Europe’s commitment to transparency and the rule of law.
Sources:
Portuguese Ministry of Justice, Special Security Programme of Rui Pedro Gonçalves Pinto, 9 October 2026: https://portugal.gov.pt/gc25/comunicacao/comunicados/programa-especial-de-seguranca-de-rui-pedro-goncalves-pinto-1
The Guardian, Portuguese authorities took 83 days to tell Rui Pinto his witness protection was ending, 7 October 2026: https://www.theguardian.com/football/2026/oct/07/rui-pinto-witness-protection-ending-portuguese-authorities-manchester-city
The Portugal Post, https://theportugalpost.com/posts/portugal-revokes-protection-for-whistleblower-rui-pinto-as-threats-rise
Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law.
https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng
Audit Report of Ombudsman of Republic of Bulgaria 2025: