Abstract;Judgment — ECLI:EU:C:2024:827
Date: 2024-10-04
Language of the case: Bulgarian
Court formation: First Chamber
Subject matter: Right of establishment;Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Bulgaria

Summary C-200/23 – 1 
Case C-200/23 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
28 March 2023 
Referring court: 
Varhoven administrativen sad (Bulgaria) 
Date of the decision to refer: 
21 March 2023 
Appellant in cassation: 
Agentsia po vpisvaniyata 
Respondent in cassation: 
OL 
  
Subject matter of the main proceedings 
The main proceedings have their origin in the appeal in cassation brought by the 
Agentsia po vpisvaniyata (Registration Agency, ‘the AV’) against the judgment of 
the Administrativen sad Dobrich (Administrative Court, Dobrich) annulling a 
letter from the Izpalnitelen direktor (Executive Director) of the AV and ordering 
the AV to pay compensation in the amount of LEV (BGN) 500 to OL for the non-
material damage suffered by her in the form of negative emotions and experiences 
resulting from that letter, which infringed her right to erasure under Article 17(1) 
of Regulation 2016/679.  
Subject matter and legal basis of the request 
Interpretation of EU law; Article 267 TFEU 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-200/23 
 
2  
Questions referred for a preliminary ruling 
1. May Article 4(2) of Directive 2009/101/EC be interpreted as meaning that it 
imposes an obligation on the Member State to permit the disclosure of an 
instrument of memorandum and articles of association, which is subject to 
registration under Article 119 of the Targovski zakon (Commercial Code), 
in the case where that instrument contains not only the names of the 
members of the company, which are subject to compulsory disclosure under 
Article 2(2) of the Zakon za targovskia registar i registara na yuriditcheskite 
litsa s nestopanska tsel (Law on the Commercial Register and the Register of 
Not-for-Profit Legal Persons), but also other personal data? When answering 
this question, it is important to take into account that the Registration 
Agency is a public-sector body against which the directly effective 
provisions of the aforementioned directive may be relied on, in accordance 
with the settled case-law of the Court of Justice (judgment of 7 September 
2006, Vassallo, С-180/04, ECLI:EU:C:2006:518, paragraph 26 and the case-
law cited). 
2. If the first question is answered in the affirmative, may it be assumed that, in 
the circumstances which gave rise to the dispute in the main proceedings, 
the processing of personal information by the Registration Agency is 
necessary for the performance of a task carried out in the public interest or in 
the exercise of official authority vested in the controller, within the meaning 
of Article 6(1)(e) of Regulation 2016/679? 
3. If the first two questions are answered in the affirmative, may a national 
provision such as that contained in Article 13(9) of the Zakon za targovskia 
registar i registara na yuriditcheskite litsa s nestopanska tsel (Law on the 
Commercial Register and the Register of Not-for-Profit Legal Persons), in 
accordance with which, in the event that personal data not required by law 
are contained in an application [for registration] or in the documents 
annexed thereto, it must be assumed that the persons who made those data 
available consented to the processing thereof by the Agency and to the 
provision of public access thereto, be regarded as permissible, 
notwithstanding recitals 32, 40, 42, 43 and 50 of Regulation 2016/679, as a 
clarification of the possibility of ‘voluntary disclosure’, within the meaning 
of Article 4(2) of Directive 2009/101/EC, even of personal data? 
4. Is it permissible for provisions of national law intended to give effect to the 
obligation laid down in Article 3(7) of Directive 2009/101/EC, whereby 
Member States are to take the necessary measures to avoid any discrepancy 
between what is disclosed in accordance with paragraph 5 and what appears 
in the register or file, and to take into account the interests of third parties in 
being acquainted with the essential documents of the company and certain 
information concerning the company, as referred to in recital 3 of that 
directive, to prescribe a procedure (application forms, submission of copies 
of documents in which personal data have been redacted) for exercising the 
AGENTSIA PO VPISVANIYATA 
 
3 
right of natural persons under Article 17 of Regulation 2016/679 to obtain 
from the controller the erasure of personal data concerning him or her 
without undue delay, in the case where the personal data the erasure of 
which is sought are part of publicly disclosed (notified) documents which 
were made available to the controller, in accordance with a similar 
procedure, by another person who, in so doing, also determined the purpose 
of the processing initiated by him or her? 
5. In the situation underlying the dispute in the main proceedings, does the 
Registration Agency act only as controller in relation to the personal data or 
is it also the recipient thereof, in the case where the purposes of processing 
those data were determined by another controller as part of the documents 
that were submitted for disclosure? 
6. Does the handwritten signature of a natural person constitute information 
relating to an identified natural person, in the sense that it is covered by the 
term ‘personal data’ within the meaning of Article 4(1) of Regulation 
2016/679? 
7. Is the concept of ‘non-material damage’ in Article 82(1) of Regulation 
2016/679 to be interpreted as meaning that the assumption of non-material 
damage requires a noticeable disadvantage and an objectively 
comprehensible impairment of personal interests, or is the mere short-term 
loss of the data subject’s unfettered control over his or her data due to the 
publication of personal data in the commercial register, which did not have 
any noticeable or adverse consequences for the data subject, sufficient for 
that purpose? 
8. May opinion No 01-116(20)/01.02.2021, issued by the national supervisory 
authority, the Komisia za zashtita na lichnite danni (Commission for the 
Protection of Personal Data), in accordance with Article 58(3)(b) of 
Regulation 2016/679, to the effect that the Registration Agency does not 
have the option or power in law to restrict of its own motion or at the request 
of the data subject the processing of data which have already been disclosed, 
permissibly be regarded as proof, for the purposes of Article 82(3), that the 
Registration Agency is in no way responsible for the circumstance which 
gave rise to the damage suffered by the natural person? 
Provisions of European Union law and case-law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
94/46/EC (General Data Protection Regulation, ‘GDPR’): Recitals 4, 32, 40, 42, 
43, 50 and 65, and Articles 2, 4, 6, 17, 58 and 82 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-200/23 
 
4  
Directive 2009/101/ЕC of the European Parliament and of the Council of 
16 September 2009 on coordination of safeguards which, for the protection of the 
interests of members and third parties, are required by Member States of 
companies within the meaning of the second paragraph of Article 48 of the Treaty, 
with a view to making such safeguards equivalent: recitals 3 and 4, Article 2(a), 
Article 3 and Article 4(2) 
Provisions of national law relied on 
Targovski zakon (Commercial Code, ‘the TZ’): Article 115, point 3, and 
Article 119 
Zakon za targovskia register i registara na yuridicheskite litsa s nestopanska tsel 
(Law on the Commercial Register and the Register of Not-for-Profit Legal 
Persons, ‘the ZTRRYULNTS’): Articles 2, 3, 6 and 11 
Naredba № 1 ot 14 fevruari 2007 г. za vodene, sahranyavane i dostap do 
targovskia register i do registara na yuridicheskite litsa s nestopanska tsel 
(Regulation No 1 of 14 February 2007 on keeping, storing and accessing the 
Commercial Register and the Register of Not-for-Profit Legal Persons): Article 6 
Succinct presentation of the facts and procedure in the main proceedings 
1 OL is a member of the company ‘Praven Shtit Konsulting OOD’, which, on 
14 January 2021, was entered in the Commercial Register kept by the AV. 
Submitted with the application for registration was an instrument of memorandum 
and articles of association, signed by the members of that company, which 
contained OL’s three names, her identification number, the number and date and 
place of issue of her identity card and her address. The instrument of 
memorandum and articles of association was registered and published in the form 
in which it had been registered. 
2 On 8 July 2021, OL asked the AV to erase her personal data as contained in the 
instrument of memorandum and articles of association and stated that, in so far as 
the processing of those data was based on her consent, she was revoking that 
consent. 
3 The AV’s failure to act on that request was the subject of a challenge as a result of 
which the Administrativen sad Dobrich (Administrative Court, Dobrich) annulled 
by final judgment the AV’s tacit refusal to erase OL’s personal data and referred 
the matter back to the AV for a new decision. 
4 In implementation of that judgment (and another judgment of the Administrativen 
sad Haskovo (Administrative Court, Haskovo) to similar effect but in respect of 
the other member of the company, RS), the AV drafted a letter, No 66-00-
758/26.01.2022, stating that grant of the request to erase personal data was 
AGENTSIA PO VPISVANIYATA 
 
5 
conditional upon the submission of a certified copy of the instrument of 
memorandum and articles of association of ‘Praven Shtit Konsulting OOD’ in 
which the personal data of the company members, other than the personal data 
required by law, have been redacted. 
5 On 31 January 2022, OL brought directly before the Administrativen sad Dobrich 
(Administrative Court, Dobrich) an action against letter No 66-00-758/26.01.2022 
from the AV and an action for compensation in the amount of LEV (BGN) 2000 
for the non-material damage she had sustained as a result of that letter, which 
infringes her rights under Regulation 2016/679. 
6 Without having received a copy of the instrument of memorandum and articles of 
association with the company members’ personal data redacted, the AV, on 
1 February 2022, erased of its own motion OL’s identification number, the 
number and date and place of issue of her identity card and her address. OL’s 
three names and her signature were not erased. 
7 By its judgment, now being challenged before the referring court, the 
Administrativen sad Dobrich (Administrative Court, Dobrich) annulled the 
contested letter from the AV’s executive director and ordered the AV to pay OL 
compensation in the amount of BGN 500, plus statutory interest on the main claim 
from 26 January 2022 until the date of its settlement in full. That compensation 
was awarded for the non-material damage in the form of negative emotions and 
experiences caused to her by the aforementioned letter, which had infringed her 
right to erasure under Article 17(1) of the 1 DSGVO and had led to the unlawful 
processing of OL’s personal data as contained in the instrument of memorandum 
and articles of association disclosed in the Commercial Register. 
8 The Administrativen sad Dobrich (Administrative Court, Dobrich) found that the 
letter of 26 January 2022 was contrary to the final judgment and that the unlawful 
processing of the personal data of the natural person concerned was therefore 
carrying on, in breach of her rights under Article 17 of the DSGVO and 
Article 2(2) of the ZTRRYULNTS. In order to establish liability under Article 82 
of the DSGVO and to determine the amount of the compensation, the 
Administrativen sad [Dobrich] (Administrative Court, Dobrich) took into account 
the fact that the letter which it had found to have committed the breach was dated 
26 January 2022, and that the AV erased OL’s identification number, the number 
and date and place of issue of her identity card and her address on 1 February 
2022, while her signature continued unerased. The court considered it to have 
been proved that, during that time, OL had suffered negative psychological and 
emotional experiences, namely fear and anxiety caused by the potential misuse of 
her personal data, and powerlessness and disappointment in the face of being 
unable to protect her personal data, and that there was a direct causal link between 
those experiences and the letter of 26 January 2022, in which the AV, 
notwithstanding the erasure request, the absence of any consent on OL’s part to 
the ongoing processing [of her personal data] and the final judgment, took no 
steps to erase the personal data in question without delay. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-200/23 
 
6  
9 Before the referring court, the AV is challenging the judgment in so far as it 
annulled the letter and awarded compensation. The appeal is founded on the 
ground that the letter is not an individual administrative act but is in the nature of 
information on the procedure provided for in connection with the requested 
erasure of personal data. It is expressly argued that the AV is not only the 
controller but also the recipient of personal data submitted in the registration 
procedure, and that the submission of an instrument of memorandum and articles 
of association with redacted data would have enabled the personal data of the 
natural persons concerned to be processed in such a way as to take into account 
the options for restricting access to parts of those data. In support of that position, 
the AV relies on opinion No PNMD-61-116(20)/2021 of the Komisiya za zashtita 
na lichnite danni (Commission for the Protection of Personal Data) of 1 February 
2021, which the national supervisory authority had issued to the AV pursuant to 
its powers under Article 58(3)(b) of the DSGVO. 
The essential arguments of the parties in the main proceedings 
10 The AV submits that no unlawful act has been committed because, the applicant 
having failed to submit with the application to register the company concerned of 
10 January 2021 an instrument of memorandum and articles of association with 
the personal data redacted, she was advised on 12 January 2021 to submit a copy 
of the instrument of memorandum and articles of association with the personal 
data not covered by the obligation of disclosure redacted. That advice not having 
been followed, the company concerned was registered and the instrument of 
memorandum and articles of association was disclosed in the form in which it had 
been submitted (that is to say, with non-redacted personal data). The AV argues 
that there is no possibility of changing the stated circumstances for registration 
and disclosure and that the failure to submit an instrument of memorandum and 
articles of association in which the personal data [have been] redacted is no reason 
to refuse in principle to register a company. In its view, the letter of 26 January 
2022 simply provides information on the statutory procedure for erasing 
previously disclosed personal data. 
11 In the view of the AV, it has not been proved that the letter of 26 January 2022 
caused damage described as a ‘feeling of powerlessness and disappointment’ at 
not being able to protect personal data[’]; if OL was indeed perturbed because her 
data was accessible to the public, she had the option of submitting to the AV for 
disclosure a copy of the instrument of memorandum and articles of association 
with the personal data redacted, so as to ensure that that state of affairs did not 
carry on, instead of taking the more protracted route of seeking judicial relief. 
12 In addition, the AV denies the existence of a causal connection between the letter 
of 22 January 2022 and OL’s emotional experiences. 
13 OL takes issue with all of AV’s arguments and is of the view that the AV is the 
personal data controller and that it is not permissible for it to impose on others its 
AGENTSIA PO VPISVANIYATA 
 
7 
own obligations in connection with the erasure of the personal data of natural 
persons. She relies on case-law to the effect that the opinion of the national 
supervisory authority on the protection of personal data is contrary to Regulation 
2016/679 and puts forward detailed reasons for her position that the AV processes 
personal data in a manner contrary to Community law. She further submits that 
notifications have already been sent to the European Commission (No 
СНАР(2022)0864/18.02.2022) and to the Ministar na pravosadieto (Minister for 
Justice) (No 014-00-118/18.05.2022). 
Succinct presentation of the reasoning in the request for a preliminary ruling 
14 In addition to the abovementioned judgment of the Administrativen sad Haskovo 
(Administrative Court, Haskovo), in a case in which RS, the other member of the 
company ‘Praven Shtit Konsulting OOD’ was a party, there are numerous other 
judicial decisions concerning the [exercise of the] right provided for in 
Article 17(1) of the DSGVO in similar factual circumstances. By judgment 
No 789/25.01.2023 of the Varhoven administrativen sad (Supreme Administrative 
Court), judgment No 167/04.05.2022 of the Administrativen sad Dobrich 
(Administrative Court, Dobrich) was set aside in so far as it ordered the AV to pay 
a natural person compensation in the amount of BGN 500 for non-material 
damage in the form of negative emotions and experiences caused by a letter from 
the Executive Director of the AV the content of which is identical to that of the 
letter of 26 January 2022. The Varhoven administrativen sad (Supreme 
Administrative Court) held that, the personal data of the natural person concerned 
as contained in the instrument of memorandum and articles of association having 
been erased [by the AV] of its own motion, and the dispute having to that extent 
been terminated, it was not permissible to adjudicate on an independent action for 
compensation for refusal to erase data. 
15 Preceding that judgment and the main proceedings [in that case] are numerous 
other disputes which have their origin in requests made by natural persons to the 
AV for the erasure of their personal data as disclosed in the public registers kept 
by the AV. Depending on the specific features of the appeals lodged and the 
procedural steps taken or judgments given by the courts of first instance, the court 
of last instance, the Varhoven administrativen sad (Supreme Administrative 
Court), has developed a line of case-law which can be divided into three groups of 
judgments. 
16 In the first group, the court finds that the action before it is directed against a letter 
of abstract content and in the nature of information which is said to be an 
individual administrative act of the Executive Director of the AV but which does 
not exhibit any of the characteristics of an [administrative] act of the kind open to 
challenge by way of the proceedings in question, with the result that the 
proceedings instituted by such an action are impermissible. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-200/23 
 
8  
17 The second group comprises court judgments on actions which have already been 
directed against a refusal by the AV to erase personal data, so that the appeals are 
held to be admissible for examination, but the cases in which are for procedural 
reasons referred back to the AV for a new decision. In some of the judgments in 
this group, the courts have drawn legal conclusions to the effect that the 
processing of personal data is unlawful because Article 13(9) of the 
ZTRRYULNTS assumes consent and this is contrary to the DSGVO. 
18 The decisions in the third group also set aside the judgments at first instance on 
procedural grounds and refer the cases back for a new decision, with instructions 
on how the law is to be applied. 
19 The referring Chamber takes the view that, notwithstanding that the case-law of 
the court of last instance adjudicating on disputes in connection with the 
application of Regulation 2016/67 is not formally contradictory, there is no clear 
consensus among the parties and the courts in Bulgaria in this regard. For the most 
part, the grounds of the judgments draw the conclusion that the Komisiya za 
zashtita na lichnite danni (Commission for the Protection of Personal Data) issued 
an erroneous opinion providing an incorrect explanation of the AV’s powers in 
respect of requests it receives to erase personal data. Such a contradictory 
interpretation of the provisions of the DSGVO in the opinion issued by the 
national supervisory authority, on the one hand, and in judgments binding only on 
the parties in the case concerned, on the other, is indicative of how difficult it is to 
find the true meaning of the applicable EU law. The risk of a misinterpretation of 
the relevant provisions in a multitude of cases pending before courts of different 
instances can be avoided only by submitting a request for a preliminary ruling to 
the Court of Justice of the European Union, which can provide a universally 
binding explanation of the meaning of the applicable law. 
20 The case-law of the Court of Justice of the European Union of which the referring 
court is aware, namely the judgments of 9 March 2017, Manni (С-319/15, 
EU:C:2017:197), of 7 May 2007, Rijkeboer (С-553/07, EU:C:2009:293), and of 
24 September 2019, GC and Others (С-136/17, EU:C:2019:773), does not answer 
the questions which are relevant to the correct adjudication of the case brought by 
the AV’s appeal in cassation. While it may be that the judgment, when given, of 
the Court of Justice of the European Union in Case C-456/22, on the request for a 
preliminary ruling received on 8 July 22 from the Landgericht Ravensburg 
(Regional Court, Ravensburg) (Germany), will provide clarification of the concept 
of ‘non-material damage’, within the meaning of Article 82(1) of Regulation 
2016/679, which may be of use in the present case, it is not inconceivable, in the 
light of the particular features of the main proceedings, that the answer expected 
to be given by the Court of Justice of the European Union will not be sufficient for 
the purposes of the decision in the main proceedings. In her Opinion of 6 October 
1922 in Norra Stockholm Bygg (С-268/21, EU:C:2022:755, points 18, 19 and 22), 
Advocate General T. Ćapeta starts from the premiss that the data controller 
determines the purpose and means of the processing of personal data, and raises 
the possibility that a person may have different roles in relation to the same 
AGENTSIA PO VPISVANIYATA 
 
9 
personal data, as data controller, as data recipient or as both, depending on the 
purpose of the processing. Since that part of the Opinion is not discussed in the 
judgment of the Court of Justice in that case (judgment of 2 March 2023, Norra 
Stockholm Bygg, С-268/21, EU:C:2023:145), the Court’s view on the questions 
raised is not clear, even though it would be of crucial relevance in the present 
case. The effects which the DSGVO has on all areas of law, in terms of 
reconciling the right to protection of the personal data of natural persons which it 
enshrines with the pre-existing law guaranteeing public disclosure and access to 
certain activities, including to trade, call for an extremely careful interpretation of 
each of its provisions which is clear and binding on all national authorities that 
apply it. 
21 Since its decision in this case is not open to challenge, the referring court takes the 
view that it has a duty, given the uncertainties and difficulties that exist in relation 
to the interpretation of the relevant provisions of Community law, to avail itself of 
the cooperation procedure and to submit this request for a preliminary ruling to 
the Court of Justice, in order to avert a misinterpretation of provisions of 
Community law and contradictory case-law.