Changes to personal data protection rules in Bulgaria

From 25.05.2018, new personal data protection rules will apply in all EU member states, including Bulgaria. They are set out in the GDPR system (General Data Protection Regulation). Checks on compliance with the Bulgarian Personal Data Protection Act (ЗЗЛД) will begin at the end of May. They will be carried out by a special commission.

The law can be read at this link.

Under the ЗЗЛД, personal data means any information relating to a natural person that makes it possible to identify them directly or indirectly.

Consent to the processing of personal data (PD) is one of the grounds for lawful processing of personal information. The personal data administrator is required to be able to prove that the personal information was provided:

• Voluntarily, without pressure.
• By means of an explicit statement.
• Under an agreement setting out the specific purposes and accurate, complete and clearly presented information about the use of the data.

The principle of accountability of data controllers means that consent must be documented in order to demonstrate that it is available.

What information may not be collected

It is prohibited to collect and process personal information about:

• nationality and ethnic origin;
• sexual life;
• health;
• genes;
• political, philosophical and religious beliefs;
• membership in organisations with political, trade union, philosophical and religious aims, and in political parties.

The prohibition also covers personal data that:

• relate to a person’s state of health, genes and sexual life;
• reveal nationality, ethnic or racial origin;
• reveal membership in organisations with political, religious, philosophical or trade union aims, or disclose the corresponding beliefs.

Exceptions

In a number of cases the prohibition does not apply. The collection and processing of personal data are possible in the following cases:

• If it is necessary in order to exercise specific rights and obligations of the administrator in the field of labour law.
• If explicit consent to the processing of the data has been obtained from the natural person to whom they relate.
• If it is necessary to protect the health and life of the natural person to whom the data relate and who is unable to give consent because of their condition or legal complications.
• If they are carried out by a non-profit organisation, including one of a political, religious, philosophical or trade union nature, in the course of its lawful activity and with appropriate safeguards in place. In such a case the processing may relate only to members of the organisation or to persons who are in regular contact with it and share its aims. In addition, disclosure of the information to third parties requires the consent of those to whom it relates.
• If the data concerned were previously made public by the natural person.
• If the data are necessary for the establishment, defence and exercise of rights before a court.
• If the need for processing is driven by medical purposes — the data are required for preventive medicine, diagnosis, the provision of medical services or their management. In this case the information must be processed by a doctor who is legally bound by professional secrecy, or by another person who is obliged to protect privacy and observe confidentiality.
• If the purpose is solely literary, artistic or journalistic expression — up to the point at which the processing of the data begins to infringe the privacy of the person the information directly concerns.

Sanctions

Under the Bulgarian ЗЗЛД, sanctions are provided for breaches.

If the purposes of collecting and processing the information do not match, or if data collection begins before registration as an administrator, the fine or property sanction is between 10 and 100 thousand leva. The same amount will have to be paid in the event of a refusal to cooperate with the personal data protection commission.

For a breach of Article 5 (on data that may not be processed) or a refusal by the PD administrator to provide their details to the person directly affected by the collection and processing, sanctions of between 2 and 20 thousand leva are provided. The same fine applies if the PD administrator is not entered in the register of organisations that process personal information, or has failed to comply with an instruction of the relevant commission. From 2000 to 20000 leva will also have to be paid if the PD administrator does not provide the required information orally or in writing at the request of the personal data protection commission, or does not grant the commission access.

If the PD administrator leaves a written request from a natural person under Articles 26, 28, 28 of the ЗЗЛД unanswered, the sanctions will be between 1 and 20 thousand leva, except in cases where such actions are punishable by more severe penalties.

Other breaches of the law are punishable by a fine or property sanctions of between 500 and 5000 leva.

If your company collects, processes and uses personal data of individuals in its activities, then by 25.05.2018 you need to register as a personal data administrator, conclude agreements to that effect with clients and counterparties, and carefully observe all the requirements of the ЗЗЛД.

To the list of all news