Source: https://www.jdsupra.com/legalnews/gdpr-guide-to-national-implementation-50695/
Timestamp: 2020-01-28 13:14:11
Document Index: 227960462

Matched Legal Cases: ['Art. 36', 'Art. 26', 'Art. 36', 'Art. 36', 'Art. 55', 'Art. 58', 'Art. 12', 'Art. 15', 'Art. 5', 'Art. 58', 'Art. 6']

GDPR Guide to National Implementation: Bulgaria - A practical guide to national GDPR compliance requirements across the EEA | White & Case LLP - JDSupra
[co-authors: Ventsislav Tanev and Milena Ivanova, SMTLegal]
Date in force: 1 January 2002
Law on Amendment and Supplement to the Personal Data Protection Act
Date in force: 29 February 2019
Date in force: 25 May 2007
Rules on the activity of the commission for personal data protection and its administration
Date in force: 10 February 2009
Instruction No. 1 of 21 December 2016 on the circumstances under which undertakings providing public electronic communications services notify consumers for personal data breaches, the form and ways of notification
Date in force: 6 January 2017
The PDPA does not apply to processing of personal data of deceased persons.
When processing personal data of deceased persons, the controller or the processor must take the appropriate measures to ensure that the rights and freedoms of others or the public interest would not be adversely affected.
When a request for access to such data is made, the controller must provide it, including copies of the data, to the deceased’s heirs or to other persons with a legitimate interest.
The national law does not have specific rules for the processing of personal data in compliance with a legal obligation.
The PDPA implements the right of Member States under Art. 36(5) GDPR, whereby under Bulgarian law, prior consultation must also take place where data are processed for the performance of a task carried out in the public interest.
In addition, according to the PDPA, the processing of personal data for the purposes of the National Archive Funds of the Republic of Bulgaria is considered to be in the public interest. In these cases, Arts. 15-16 & 18-21 GDPR do not apply.
The Law on Amendment and Supplement to the Personal Data Protection Act provided changes in the Anti-Money Laundering Measures Act according to which the provisions of Arts. 12-22 & 34 GDPR cannot restrict the processing of personal data for the purposes of money laundering and financing of terrorism. This processing of personal data is deemed to be carried out in the public interest.
There are no specific criteria.
The Bulgarian Insurance Code provides a right for insurers to access health data of insured individuals or of individuals applying for insurance. Under the Insurance Code, insurers can have access to the relevant data in the following circumstances:
they can obtain it from public authorities and third parties for the establishment of an insured event and the damages caused by such event; or
before the conclusion of a life insurance contract and during the term of the contract, the insurer is entitled to receive detailed and accurate information about the age, gender, health and financial status of the person whose life, health or physical integrity will be covered by insurance.
According to the PDPA, personal data relating to criminal convictions can be processed when:
the court acts in its judicial capacity; and
the prosecution and the investigating authorities act in their judicial capacity for the purpose of preventing, investigating, detecting or prosecuting criminal offences or executing criminal penalties. The Inspectorate of the Supreme Judicial Council is the body responsible for supervising compliance with the GDPR, the PDPA and other statutory instruments governing the processing of personal data.
Where the court, the prosecution or the investigating authorities have infringed a data subject’s rights under the GDPR and the PDPA, the data subject has the right to submit a complaint to the Inspectorate within six months after becoming aware of the infringement, but no later than two years after the infringement.
In addition, in order to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, the controller may delay or refuse, in whole or in part, the provision of information to the data subject regarding:
the recipients of the data; or
any further information, in particular where the personal data are collected without the knowledge of the data subject.
A data subject’s right to erasure may be refused when the retention of the personal data is necessary in order to:
avoid obstructing official or legal checks, investigations or procedures;
protect public order and security;
When protecting the rights and freedoms of others, the controller must take into account the fundamental rights and legitimate interests of the data subject.
The controller must inform the data subject in writing of its refusal and of the reasons for such refusal. The controller must respond within two months of receipt of the request. That period may be extended by one additional month if necessary, taking into account the complexity and number of requests.
The controller must inform the data subject of the right to lodge a complaint with the DPA or, as the case may be, with the Inspectorate and to seek a judicial remedy.
In addition to the rules provided in Art. 26 GDPR, the PDPA provides that the controllers’ joint rules must designate a contact point for data subjects, and the joint controllers may indicate one of the said controllers to act as a single contact point. In addition, the DPA has issued guidelines on apportionment of liability in joint controllerships.
In addition to the cases referred to in Art. 36(1) GDPR, it is provided that prior consultation is required where data are processed for the performance of a task carried out in the public interest, including processing in relation to social protection and public health.
In such cases, the DPA may authorise the processing within the timelines referred to in Art. 36(2) GDPR.
The Inspectorate to the Supreme Judicial Council also has the authority to carry out prior consultations.
Name of DPA: Commission for Personal Data Protection
Address: 2, Prof. Tsvetan Lazarov blvd Sofia 1592, Bulgaria
The Inspectorate to the Supreme Judicial Council supervises the processing of personal data by the courts, prosecutors and investigative bodies when acting in the performance of their functions as judiciary bodies, including in cases of complaints by data subjects concerning the processing of their personal data.
This is in compliance with Recital 20 and Art. 55(3) GDPR which does not extend the competence of the DPA to the processing of personal data when the courts are acting in the exercise of their judicial functions, in order to guarantee the independence of the judiciary in the performance of its judicial duties. The procedure regulating the activities of the Inspectorate is established by the Judicial System Act.
The two data protection authorities (the DPA and the Inspectorate) have separate competencies:
the Inspectorate is responsible for:
enforcement of the GDPR, the PDPA and other data protection laws in the context of: (i) the judicial operation of the courts; and (ii) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
participating in international cooperation with DPAs in other Member States and international organisations on issues relating to personal data protection; and
issuing data protection guidelines, rules and recommendations.
the DPA is responsible for:
exercising the powers and obligations of a DPA under Arts. 57 & 58 GDPR;
enforcement of the rights of individuals under the GDPR and the PDPA;
helping the state to implement data protection policy; issuing data protection guidelines, rules and recommendations;
participating in international cooperation with other DPAs and international organisations on personal data protection issues;
participating in the negotiations and the conclusion of bilateral or multilateral agreements on data protection issues; and
organisation, coordination and provision of personal data protection training.
Both the Inspectorate and the DPA may bring judicial proceedings.
to refer any infringement of GDPR to the court; and
to give instructions, issue guidelines, recommendations and best practices relating to personal data protection.
Decisions of the DPA or of the Inspectorate can be appealed under the procedure of the Administrative Procedure Code within 14 days of receipt of the relevant decision.
Controllers and processors have the right to refuse access to certain data. In cases where there is a duty of professional secrecy of the controller or processor or another obligation of secrecy arising from a law that may be infringed in the exercise of the powers of the DPA pursuant to Art. 58 (1)(e)-(f) GDPR, the controller or processor may refuse access only to the information covered by the obligation of secrecy. If the information contains data which is considered classified, the procedure for access pursuant to the Classified Information Protection Act applies.
Under the Bulgarian Criminal Code anyone who creates, procures for himself or for others, imports or otherwise distributes computer programmes, passwords, codes or other similar data for access to an information system or part thereof in order to commit breach of confidentiality of correspondence, or specifically determined cybercrimes may be punished by imprisonment of up to two years. Where personal data, classified information or other secret information protected by the law are disclosed, and where the violation does not constitute a serious crime, the punishment may include imprisonment of up to three years. Where the act is committed for the purpose of satisfying self-interest or is committed by an individual acting at the orders or in implementing a decision of an organised criminal group, or if considerable damage has been caused or other serious consequences have occurred, the punishment may include imprisonment of up to five years.
Under Bulgarian law, the processing of personal data for journalistic purposes and for the purposes of academic, artistic or literary expression is lawful when carried out on the grounds of freedom of expression and the right to information, while simultaneously respecting privacy.
The PDPA provides criteria for evaluation of the balance between the freedom of expression and the right to information, and the right of personal data protection. This criteria is weighted in cases of disclosure by transmission, dissemination or otherwise making available the personal data collected for the purposes of academic, artistic or literary expression (as well as for journalistic purposes). The following non-exhaustive criteria include:
the impact that the personal data would have on the data subject’s privacy and reputation;
the circumstances under which the personal data became known to the controller;
the significance of personal data or the clarification of a matter of public interest;
the consequence of the statement when the rights are exercised; and
the compliance of the statement for exercising the rights with the fundamental rights of citizens.
Where personal data are processed for journalistic purposes and for the purposes of academic, artistic or literary expression, Arts. 6, 9-10, 30, 34 & Chapter V GDPR do not apply, as well as the provision of the PDPA governing processing of personal data of a child and the controller or processor may deny the data subjects, fully or partially, the exercise of their rights pursuant to Arts. 12-21 GDPR.
The PDPA provides that free public access to any information containing a personal identification number (or a foreigner personal number) is not permitted unless authorised by law. Where controllers provide services by electronic means, they must take appropriate technical and organisational measures to ensure that the personal identification number (or a foreigner personal number) is not the only means of identifying the user when remote access to the service is provided.
In order to provide administrative services by electronic means under the conditions of the Electronic Governance Act, the controller must make it possible for the data subject to identify himself or herself following a procedure provided by law.
Employees’ personal data in the employment context can be processed for the purposes of recruitment, staff and tax purposes. Under the Bulgarian Labour Code, the employer is required to keep a record of each employee. The employee’s employment file is created upon entry into employment and should contain the documents relating to the occurrence, existence, modification and termination of the employment relationship. There are specific provisions which provide which documents are necessary for the conclusion, existence and termination of the employment relation. Deadlines for the storage of the personal and other employment data are governed by different laws, depending on the type of document and the information it contains.
The employer or any appointing authority, in the capacity of controller, will determine a storage period for the personal data of candidates in staff selection procedures, which may not be longer than six months, unless the applicant has given consent for a longer period of storage. When the period expires, the employer or appointing authority must erase or destroy the documents containing personal data unless otherwise provided for by a special law.
Pursuant to the Bulgarian Labour Code, the employer is obliged to protect the dignity of the employee during the term of the employment relationship.
The local DPA has taken enforcement action for breaches of the GDPR, by imposing administrative penalties as follows:
a fine of BGN 1,000 (approx. €510) for violation of Art. 12 GDPR in connection with Art. 15(1)(a)-(c), (g) & (3) GDPR;
a fine of BGN 1,000 (approx. €510) for violation of Art. 5(1)(b) GDPR (in addition, pursuant to Art. 58(2)(e) GDPR, the DPA has imposed a definitive limitation on processing personal data within the prescribed time-limit for storage of personal data); and
a fine of BGN 53,000 (approx. €27,000) for violation of Art. 6(1) GDPR.
The DPA has issued the following guidance (in Bulgarian):
practical Q&A on personal data protection after 25 May 2018 (see here);
guidance on cases in which consent is not required for processing of personal data (see here);
guidance on the right to be forgotten in the context of the processing of personal data for journalistic purposes (see here); and
guidance on the deadlines for the storage of personal data of participants in personnel recruitment and selection procedures (see here).