Bulgaria
Other chapters
Foreword and issue-by-issue comparison
Bulgaria
Get your copy
Request a hard copy of the GDPR Guide to National Implementation »
In this chapter:
Q1/ Applicable legislation
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
Old legislation has been updated.
———
(b) Relevant legislation includes:
- Personal Data Protection Act (“PDPA”)
- Date in force: 1 January 2002
- Link: see here
- Law on Amendment and Supplement to the Personal Data Protection Act
- Date in force: 29 February 2019
- Link: see here
- Electronic Communications Act
- Date in force: 25 May 2007
- Link: see here
- Rules on the activity of the commission for personal data protection and its administration
- Date in force: 10 February 2009
- Link: see here
- Instruction No. 1 of 21 December 2016 on the circumstances under which undertakings providing public electronic communications services notify consumers for personal data breaches, the form and ways of notification
- Date in force: 6 January 2017
- Link: see here
———
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been revised.
Q2/ Personal data of deceased persons
Does national law make specific rules regarding the processing of personal data of deceased persons?
The PDPA does not apply to processing of personal data of deceased persons.
When processing personal data of deceased persons, the controller or the processor must take the appropriate measures to ensure that the rights and freedoms of others or the public interest would not be adversely affected.
When a request for access to such data is made, the controller must provide it, including copies of the data, to the deceased’s heirs or to other persons with a legitimate interest.
Q3/ Legal bases for processing
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
The national law does not have specific rules for the processing of personal data in compliance with a legal obligation.
———
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
The PDPA implements the right of Member States under Art. 36(5) GDPR, whereby under Bulgarian law, prior consultation must also take place where data are processed for the performance of a task carried out in the public interest.
In addition, according to the PDPA, the processing of personal data for the purposes of the National Archive Funds of the Republic of Bulgaria is considered to be in the public interest. In these cases, Arts. 15-16 & 18-21 GDPR do not apply.
The Law on Amendment and Supplement to the Personal Data Protection Act provided changes in the Anti-Money Laundering Measures Act according to which the provisions of Arts. 12-22 & 34 GDPR cannot restrict the processing of personal data for the purposes of money laundering and financing of terrorism. This processing of personal data is deemed to be carried out in the public interest.
———
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
There are no specific rules governing this issue.
———
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific criteria.
Q4/ Consent of children
At what age can a child give their consent to processing in relation to ISS?
14 years of age.
Q5/ Processing of sensitive personal data
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
All sensitive personal data can be processed if the data subject’s valid consent has been obtained.
———
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
There are no specific rules on processing this category of data.
(ii) Substantial public interest
There are no specific rules on processing this category of data.
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
There are no specific rules on processing this category of data.
(iv) Public interest in the area of public health
There are no specific rules on processing this category of data.
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
There are no specific rules on processing this category of data.
———
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
The Bulgarian Insurance Code provides a right for insurers to access health data of insured individuals or of individuals applying for insurance. Under the Insurance Code, insurers can have access to the relevant data in the following circumstances:
- they can obtain it from public authorities and third parties for the establishment of an insured event and the damages caused by such event; or
- before the conclusion of a life insurance contract and during the term of the contract, the insurer is entitled to receive detailed and accurate information about the age, gender, health and financial status of the person whose life, health or physical integrity will be covered by insurance.
Q6/ Data relating to criminal offences or convictions
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
According to the PDPA, personal data relating to criminal convictions can be processed when:
- the court acts in its judicial capacity; and
- the prosecution and the investigating authorities act in their judicial capacity for the purpose of preventing, investigating, detecting or prosecuting criminal offences or executing criminal penalties. The Inspectorate of the Supreme Judicial Council is the body responsible for supervising compliance with the GDPR, the PDPA and other statutory instruments governing the processing of personal data.
Where the court, the prosecution or the investigating authorities have infringed a data subject’s rights under the GDPR and the PDPA, the data subject has the right to submit a complaint to the Inspectorate within six months after becoming aware of the infringement, but no later than two years after the infringement.
In addition, in order to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, the controller may delay or refuse, in whole or in part, the provision of information to the data subject regarding:
- the legal basis for processing;
- the period for which the data will be stored;
- the recipients of the data; or
- any further information, in particular where the personal data are collected without the knowledge of the data subject.
Q7/ Exemptions
(a) Does national law specify exemptions to a data subject’s right to erasure?
A data subject’s right to erasure may be refused when the retention of the personal data is necessary in order to:
- avoid obstructing official or legal checks, investigations or procedures;
- avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
- protect public order and security;
- protect national security; or
- protect the rights and freedoms of others.
When protecting the rights and freedoms of others, the controller must take into account the fundamental rights and legitimate interests of the data subject.
The controller must inform the data subject in writing of its refusal and of the reasons for such refusal. The controller must respond within two months of receipt of the request. That period may be extended by one additional month if necessary, taking into account the complexity and number of requests.
The controller must inform the data subject of the right to lodge a complaint with the DPA or, as the case may be, with the Inspectorate and to seek a judicial remedy.
———
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
There are no specific exemptions to the right to be provided information.
———
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
There are no specific exemptions to the right to not be subject to automated individual decision-making.
Q8/ Restrictions on data subjects’ rights
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
There are no additional restrictions on data subjects’ rights.
Q9/ Joint controllership
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
In addition to the rules provided in Art. 26 GDPR, the PDPA provides that the controllers’ joint rules must designate a contact point for data subjects, and the joint controllers may indicate one of the said controllers to act as a single contact point. In addition, the DPA has issued guidelines on apportionment of liability in joint controllerships.
Q10/ Processor
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
There are no additional pieces of legislation.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
Impact Assessments are only required in accordance with the provisions of the GDPR.
Q12/ Prior authorisation and public interest
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
In addition to the cases referred to in Art. 36(1) GDPR, it is provided that prior consultation is required where data are processed for the performance of a task carried out in the public interest, including processing in relation to social protection and public health.
In such cases, the DPA may authorise the processing within the timelines referred to in Art. 36(2) GDPR.
The Inspectorate to the Supreme Judicial Council also has the authority to carry out prior consultations.
Q13/ DPOs
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
DPOs are only mandatory in the circumstances set out in Art. 37(1) GDPR.
———
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
DPOs are not subject to secrecy obligations under national law.
Q14/ International data transfers
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
———
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are not subject to restrictions beyond those set out in the GDPR.
Q15/ DPAs
(a) Details of the DPA(s).
- Name of DPA: Commission for Personal Data Protection
- Address: 2, Prof. Tsvetan Lazarov blvd Sofia 1592, Bulgaria
- Website: cpdp.bg
———
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
The Inspectorate to the Supreme Judicial Council supervises the processing of personal data by the courts, prosecutors and investigative bodies when acting in the performance of their functions as judiciary bodies, including in cases of complaints by data subjects concerning the processing of their personal data.
This is in compliance with Recital 20 and Art. 55(3) GDPR which does not extend the competence of the DPA to the processing of personal data when the courts are acting in the exercise of their judicial functions, in order to guarantee the independence of the judiciary in the performance of its judicial duties. The procedure regulating the activities of the Inspectorate is established by the Judicial System Act.
———
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
The two data protection authorities (the DPA and the Inspectorate) have separate competencies:
- the Inspectorate is responsible for:
- enforcement of the GDPR, the PDPA and other data protection laws in the context of: (i) the judicial operation of the courts; and (ii) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
- participating in international cooperation with DPAs in other Member States and international organisations on issues relating to personal data protection; and
- issuing data protection guidelines, rules and recommendations.
- the DPA is responsible for:
- exercising the powers and obligations of a DPA under Arts. 57 & 58 GDPR;
- enforcement of the rights of individuals under the GDPR and the PDPA;
- helping the state to implement data protection policy; issuing data protection guidelines, rules and recommendations;
- participating in international cooperation with other DPAs and international organisations on personal data protection issues;
- participating in the negotiations and the conclusion of bilateral or multilateral agreements on data protection issues; and
- organisation, coordination and provision of personal data protection training.
Both the Inspectorate and the DPA may bring judicial proceedings.
———
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The DPA has the following additional powers:
- to refer any infringement of GDPR to the court; and
- to give instructions, issue guidelines, recommendations and best practices relating to personal data protection.
———
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
Decisions of the DPA or of the Inspectorate can be appealed under the procedure of the Administrative Procedure Code within 14 days of receipt of the relevant decision.
———
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
Controllers and processors have the right to refuse access to certain data. In cases where there is a duty of professional secrecy of the controller or processor or another obligation of secrecy arising from a law that may be infringed in the exercise of the powers of the DPA pursuant to Art. 58 (1)(e)-(f) GDPR, the controller or processor may refuse access only to the information covered by the obligation of secrecy. If the information contains data which is considered classified, the procedure for access pursuant to the Classified Information Protection Act applies.
Q16/ Claims by not-for-profit bodies
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
There are no not-for-profit bodies that are specifically mandated to bring such claims.
Q17/ Administrative fines, penalties and sanctions
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
There are no specific rules regarding fines for public authorities.
———
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
Under the Bulgarian Criminal Code anyone who creates, procures for himself or for others, imports or otherwise distributes computer programmes, passwords, codes or other similar data for access to an information system or part thereof in order to commit breach of confidentiality of correspondence, or specifically determined cybercrimes may be punished by imprisonment of up to two years. Where personal data, classified information or other secret information protected by the law are disclosed, and where the violation does not constitute a serious crime, the punishment may include imprisonment of up to three years. Where the act is committed for the purpose of satisfying self-interest or is committed by an individual acting at the orders or in implementing a decision of an organised criminal group, or if considerable damage has been caused or other serious consequences have occurred, the punishment may include imprisonment of up to five years.
Q18/ Freedom of expression and information
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
Under Bulgarian law, the processing of personal data for journalistic purposes and for the purposes of academic, artistic or literary expression is lawful when carried out on the grounds of freedom of expression and the right to information, while simultaneously respecting privacy.
———
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
The PDPA provides criteria for evaluation of the balance between the freedom of expression and the right to information, and the right of personal data protection. This criteria is weighted in cases of disclosure by transmission, dissemination or otherwise making available the personal data collected for the purposes of academic, artistic or literary expression (as well as for journalistic purposes). The following non-exhaustive criteria include:
- the nature of the personal data;
- the impact that the personal data would have on the data subject’s privacy and reputation;
- the circumstances under which the personal data became known to the controller;
- the significance of personal data or the clarification of a matter of public interest;
- the consequence of the statement when the rights are exercised; and
- the compliance of the statement for exercising the rights with the fundamental rights of citizens.
Where personal data are processed for journalistic purposes and for the purposes of academic, artistic or literary expression, Arts. 6, 9-10, 30, 34 & Chapter V GDPR do not apply, as well as the provision of the PDPA governing processing of personal data of a child and the controller or processor may deny the data subjects, fully or partially, the exercise of their rights pursuant to Arts. 12-21 GDPR.
Q19/ National identification numbers
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
The PDPA provides that free public access to any information containing a personal identification number (or a foreigner personal number) is not permitted unless authorised by law. Where controllers provide services by electronic means, they must take appropriate technical and organisational measures to ensure that the personal identification number (or a foreigner personal number) is not the only means of identifying the user when remote access to the service is provided.
In order to provide administrative services by electronic means under the conditions of the Electronic Governance Act, the controller must make it possible for the data subject to identify himself or herself following a procedure provided by law.
Q20/ Processing in the context of employment
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
Employees’ personal data in the employment context can be processed for the purposes of recruitment, staff and tax purposes. Under the Bulgarian Labour Code, the employer is required to keep a record of each employee. The employee’s employment file is created upon entry into employment and should contain the documents relating to the occurrence, existence, modification and termination of the employment relationship. There are specific provisions which provide which documents are necessary for the conclusion, existence and termination of the employment relation. Deadlines for the storage of the personal and other employment data are governed by different laws, depending on the type of document and the information it contains.
The employer or any appointing authority, in the capacity of controller, will determine a storage period for the personal data of candidates in staff selection procedures, which may not be longer than six months, unless the applicant has given consent for a longer period of storage. When the period expires, the employer or appointing authority must erase or destroy the documents containing personal data unless otherwise provided for by a special law.
———
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
Pursuant to the Bulgarian Labour Code, the employer is obliged to protect the dignity of the employee during the term of the employment relationship.
Q21/ Other material derogations
Are there any other material derogations from, or additions to, the GDPR under national law?
There are no other material derogations.
Q22/ Current legal challenges
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Q23/ Enforcement
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
The local DPA has taken enforcement action for breaches of the GDPR, by imposing administrative penalties as follows:
- a fine of BGN 1,000 (approx. €510) for violation of Art. 12 GDPR in connection with Art. 15(1)(a)-(c), (g) & (3) GDPR;
- a fine of BGN 1,000 (approx. €510) for violation of Art. 5(1)(b) GDPR (in addition, pursuant to Art. 58(2)(e) GDPR, the DPA has imposed a definitive limitation on processing personal data within the prescribed time-limit for storage of personal data); and
- a fine of BGN 53,000 (approx. €27,000) for violation of Art. 6(1) GDPR.
Q24/ Regulatory Guidance
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA has issued the following guidance (in Bulgarian):
- practical Q&A on personal data protection after 25 May 2018 (see here);
- guidance on cases in which consent is not required for processing of personal data (see here);
- guidance on the right to be forgotten in the context of the processing of personal data for journalistic purposes (see here); and
- guidance on the deadlines for the storage of personal data of participants in personnel recruitment and selection procedures (see here).
SMTLegal contributors
|
Ventsislav Tanev |
|
Ventsislav is one of the firm’s founders with 16+ years of experience in data privacy, anti-corruption and AML regulations. Since 2002 Ventsislav has advised international clients in the automotive, telecom and the pharmaceutical industries on various aspects of personal data protection, including for application of the Safe Harbor principles (EU-US Privacy Shield after 2016). Work covered registrations of companies as personal data administrators, filing privacy registers, applications for approval of privacy data transfer and appeal of the acts of the Bulgarian DPA. Ventsislav is responsible for overseeing clients’ internal procedures and regulations to ensure data privacy compliance at local and international level. For the last two years, Ventsislav has been working on various personal data protection projects, including preparation of GAP Analysis, various policies and forms and conducting trainings for ensuring clients’ compliance with Regulation (EU) 2016/679. |
|
|
Milena Ivanova |
|
Milena joined SMTLegal in 2011. Her practice focuses on a wide range of commercial and contractual arrangements. She has broad experience with complex contract negotiations and drafting. Milena also advises clients on personal data protection and a variety of employment, immigration and work authorisation issues. After the changes in data privacy made with Regulation (EU) 2016/679, Milena has helped clients with the transition to the new legal requirement by analysing their level of compliance with GDPR and preparing internal procedures and documentation to facilitate clients’ understanding of their new obligations. |
|
Other chapters
- Foreword and issue-by-issue comparison
- Country-by-country guides:
———
See also:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
———
This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP
