CPDP (Bulgaria) - PNN-01-433/2019

CPDP - 01-433/2019
Authority:	CPDP (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 6(1)(a) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	14.04.2020
Published:
Fine:	2000 BGN
Parties:	Mr. Y.L. A political party (the name is not specified)
National Case Number/Name:	01-433/2019
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Bulgarian
Original Source:	Bulgarian DPA Bulletin 3 (84), May 2020 (in BG)
Initial Contributor:	Monika Dafinova

The Bulgarian DPA fined a political party about €1000 (BGN 2000) for processing personal data without a legal ground as required by Article 6(1) GDPR, after hiring a handwriting expert to determine that an alleged signature was fake.

English Summary

Facts

The Bulgarian DPA examined a complaint lodged by a citizen against a political party for unlawful processing of his personal data (names and personal number). The data were included in a list of supporters prepared by the political party. This type of list is a mandatory legal requirement for a person to be registered as a candidate in the elections for Bulgarian members of the European Parliament, conducted in Bulgaria on 26th May 2019.

The data subject claimed that he noticed the violation after he submitted an electronic inquiry before the Central Election Commission on 27th April 2019. He claims that he did not sign in any list in support of the registration of the person as a candidate in the elections and he did not give his consent to the processing of his personal data. The data subject considered the presence of his personal data in the abovementioned list as a violation of his rights.

The political party claimed that the data subject's personal data was lawfully processed on the ground of his explicit consent, which they claimed he gave by signing the list with supporters. In addition, the political party claimed that the data subject is not a member of the party and his personal data have not been previously processed.

Holding

The Bulgarian DPA decided that the complaint against the political party is founded and imposed a fine of BGN 2000. The provision of personal data by a political party to the Central Election Commission for the purposes of a registration of a candidate in the elections for Bulgarian members of the European Parliament is a form of personal data processing and as such shall be lawfully performed in accordance with of Art. 6, para. 1 of the GDPR.

For the purposes of clarification of the case from a legal and factual point of view, the Bulgarian DPA requested a handwriting expertise of the complainants’ signature to be conducted. After examining both signatures (the one on the list of supporters and the one given by the data subject), the National Institute of Forensics concluded that the signature are not identical. Following that, the Bulgaria DPA concluded that the processing of complainants’ personal data was unlawful – there was no explicit consent as this is one of the legal grounds for lawful processing of personal data.

Comment

Decision № -01-461/2019 г. has an equivalent reasoning but does not concern the same complainant. You can find this decision on the P.28 of the same report.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

Decision No ппН-01-433 / 2019 Sofia, 14.04.2020
The Commission for Personal Data Protection (CPDP) composed of: Chairman: Ventsislav Karadzhov and members: Tsanko Tsolov and Veselin Tselkov at a meeting held on January 29, 2020, pursuant to Art. 10, para. 1 of the Personal Data Protection Act, respectively Art. 57, § 1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Regulation ), considered on the merits complaint No. PPN-01-433 / 03.05.2019 filed by J.L.
The administrative proceedings are by the order of art. 38 of the Personal Data Protection Act (PDPA).
The Commission for Personal Data Protection was seised with a complaint filed by J.L. against a political party (PP), with allegations of illegal processing of his personal data by including them in a list of persons supporting the registration of the political entity to participate in the elections for members of the European Parliament from the Republic of Bulgaria, held on 26.05.2019 г.
The complainant claims that he has established the violation after an electronic inquiry made on 27 April 2019 at the Central Election Commission, a certified copy of which he encloses. He stated that he had not signed in support of the registration of the political entity and had not given his consent to the processing of his personal data for the specific purpose. Considers the presence of his personal data in these lists as a violation of his rights under the LPPD.
P.P. was informed about the initiated administrative proceedings and about the possibility to engage a written statement on the case.
In response, an opinion was expressed that the complaint was unfounded with allegations of legality of the processing of personal data by P.P. in the presence of an explicit consent and desire expressed by the complainant for his entry in the lists under Art. 133, para. 3, item 5 of the Electoral Code (EC) for the specific elections. In addition, it is stated that there is no data Mr. J.L. to have been a member of P.P. and his personal data to have been previously processed by the political entity.
In order to clarify the case from a legal and factual point of view and in the conditions of the official beginning of the administrative process, the Central Election Commission requested relevant evidence, in response to which a certified copy submitted by P.P. application for registration for participation in the specific elections and a certified copy on page *** of the List of voters supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. It is evident from the presented evidence that on page ***, line **** of the list there are personal data of the complainant in a volume of three names. and a single civil number, as well as a signature.
The Commission for Personal Data Protection is an independent state body that protects individuals in the processing of personal data and in accessing such data, as well as monitoring compliance with the LPPD and Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
In order to exercise its powers, the Commission should be properly seised.
The appeal shall contain the obligatorily required requisites, specified in the provision of art. 28, para. 1 of the Rules of Procedure of the Commission for Personal Data Protection and its administration (PDKZLDNA), namely: there are data about the complainant, the nature of the request, date and signature, in view of which it is regular.
The appeal is procedurally admissible, filed within the term under Art. 38, para. 1 of LPPD by a natural person with a legal interest against a competent party, a legal entity - personal data administrator within the meaning of Art. 4, § 7 of EU Regulation 2016/679 and the Electoral Code. The subject of the complaint are the allegations of illegal processing of personal data of the complainant - names and a single civil number by P.P. by including them in the List provided to the CEC of the persons supporting the registration of the political entity for participation in the elections for members of the European Parliament from the Republic of Bulgaria, held on May 26, 2019.
The appeal was referred to a competent body to rule - the CPDP, which according to its powers under Art. 10, para. 1 of LPPD in connection with Art. 57, § 1, letter "f" of Regulation (EU) 2016/679, deals with complaints against acts and actions of personal data controllers which violate the rights of data subjects related to the processing of personal data, as they do not exist the exceptions under Art. 2, § 2, letter “c” and Art. 55, § 3 of Regulation (EU) 2016/679 given the fact that the case does not concern processing activities performed by a natural person in the course of purely personal or domestic activities and / or activities performed by the courts in the performance of their judicial functions.
For the stated reasons and given the lack of negative prerequisites specified in Art. 27, para. 2 of the APC, at a meeting of the CPDP held on 09.10.2019, the appeal was accepted as procedurally admissible and as parties to the proceedings were constituted: complainant J.L. and the respondent - P.P.
In order to clarify the case from a legal and factual point of view, it is allowed to perform handwriting expertise of the signature placed on page ***, line **** of the list of voters submitted to the CEC, supporting the registration of P.P. for participation in the elections of members of the European Parliament from the Republic of Bulgaria on 26.05.2019. For the purposes of the latter the applicant provided comparative material, which was sent to the National Institute of Forensics (NIC).
A graphic expertise was prepared, reflected in Protocol No. 19 / DOK-270 of 18.11.2019, according to the inventory of NIC, sent to the CPDP with an accompanying letter PPN-01-433 # 9 / 20.11.2019, with the conclusion that the signature object of the expertise was not laid by the applicant J.L.
With a decision from a meeting of the CPDP held on 04.12.2019, the appeal is scheduled for consideration on the merits on 29.01.2020, of which the parties have been regularly notified. The parties were provided with a copy of the expertise prepared in the case and were given the opportunity to express an opinion on it, to point out new evidence, to make requests on the evidence, but no such evidence was filed.
At a meeting of the Commission held on 29 January 2020, the complaint was examined on the merits.
The parties are regularly notified - they do not appear, they do not represent themselves.
As an administrative body and in connection with the need to establish the truth of the case, as a basic principle in the administrative proceedings, according to Art. 7 of the APC, requiring the existence of established actual facts and given the evidence gathered and the allegations, the commission accepts that considered on the merits complaint No. PPN-01-433 / 03.05.2019 is justified.
There is no dispute between the parties on the facts. It is notorious that on 26.05.2019 elections were held for members of the European Parliament from the Republic of Bulgaria, for participation in which, with Decision No. 136-EP of 10.04.2019 of the CEC, PP was also registered, on the basis of an application submitted. The application is accompanied by a list containing the three names, the unique civil number and the handwritten signature of 4,030 voters supporting the party's registration to run in the specific elections.
It is not disputable, and it is evident from the materials submitted by the CEC, that the personal data of the complainant JL, in a volume of three names and a single civil number, are present on page ***, line **** from the list of voters. supporting the registration of P.P. for participation in the procedural elections.
The provision of personal data by a political entity to the CEC for registration of the party for participation in the elections is a form of personal data processing and as such should be carried out in compliance with the provisions of EU Regulation 2016/679, in particular those of Art. 6, § 1 of the Regulation, the same applicable insofar as data were provided on 10.04.2019.
The allegations of the complainant for illegal processing of his personal data by P.P. for the registration of the political entity in the elections held on 26.05.2019 are justified. In support of this conclusion is the conclusion of a graphic expertise reflected in Protocol No. 19 / DOK-270 of 18.11.2019, sent to the CPDP with a cover letter PPN-01-433 # 9 / 20.11.2019, that the signature on page ***, line **** - the object of the expertise was not laid by the complainant J.L. The above testifies that the processing of the personal data of Mr. J.L. for the specific purpose was made without his consent - a specific and informed statement of intent within the meaning of Art. 4, § 11 of the Regulation. Evidence to the contrary is not involved.
In the specific case, none of the other hypotheses mentioned in Art. 6, § 1 of the Regulation, insofar as it cannot be substantiated, and there is no evidence in the file, the processing must have been carried out in fulfillment of a statutory obligation of the personal data controller or for exercising powers granted to the controller by law. for the protection of the life and health of the natural person to whom the data relate or to perform a task in the public interest or to perform obligations under a contract to which the complainant is a party. Given the lack of consent of the person to process his personal data for the specific purpose, it follows that the hypothesis of Art. 6, § 1, letter "e" of the Regulation insofar as the processing of personal data for the realization of the interests of the administrator for participation in the elections is not a priority over the interest of the affected natural person.
It is necessary to conclude that the personal data of the complainant have been processed - provided by P.P. of the CEC for the registration of the political entity for participation in elections on 26.05.2019 in violation of Art. 6, § 1 of the Regulation, without any of the conditions for admissibility of the processing specified in the provision and are a violation of the rights of the person who has referred to the CPDP.
In view of the nature of the established violation, the commission considers that the corrective measures under Art. 58, § 2 (a), (b), (c), (d), (e), "f", "g", "h" and "j" of the Regulation are inapplicable and inappropriate in this case, given the gravity of the infringement and the fact that it has been completed and is irreversible. In the present case, the pecuniary sanction provided for in Article 58 (2) (i) of the Regulation is the most appropriate, effective, dissuasive and proportionate for the protection of the legitimate public interest. It should be noted that in addition to a purely sanction measure, a reaction of the state to the violation of the statutory rules, the property sanction also has a disciplinary effect, in view of the non-commission of the same violation in the future. The administrator is obliged to know the law and to observe its requirements, moreover, that he owes the necessary care provided by law and arising from his subject of activity, human and economic resources.
In determining the amount of the sanction and in accordance with the conditions under Art. 83, § 2 of the Regulation, the commission took into account that it was a violation of the rights of a natural person. As aggravating circumstances were reported that the violation is irreparable, and the same has become known to the CPDP as a result of its referral by the victim. The commission also considers as an aggravating circumstance the fact that data on a person's unique civil number have been processed, as well as that it concerns the processing of personal data in order to create political affiliation with views and policies expressed by the political entity, as well as restriction of rights related to electoral legislation. In choosing the corrective power, and in determining the amount of the sanction, the commission also took into account that the violation is not the first, but consecutively for the administrator who is sanctioned for an identical violation by Decision No. G-792/2016 of the CPDP, and his behavior in processing personal data in the election process was sanctioned by Decision R-755 / 02.09.2015 of the Commission, which entered into force. The circumstances under Art. 83, § 2, letters “b” and “i” of the Regulation are irrelevant as far as the administrator is concerned - a legal entity that does not form a fault, and at the time of the violation approved codes of conduct, respectively approved certification mechanisms are not introduced.
The Commission considers that, in view of the principle of proportionality between the gravity of the infringement and the amount of the penalty imposed on P.P. a pecuniary sanction should amount to BGN 2,000 - an amount well below the average minimum provided for in the Regulation for this violation. Taking into account the purpose of the penalty, which should have a deterrent and warning function, the nature and severity of the violation, the public relations it affects, the categories of personal data concerned, the Commission considers that the powers exercised in type and amount indisputably 679 efficiency and deterrent effect, while not violating the principle of proportionality and the requirement of proportionality.
Guided by the above and on the grounds of Art. 38, para. 3 of LPPD, the Commission for Personal Data Protection, HAS DECIDED AS FOLLOWS:
1. Announces complaint No. ppN-01-433 / 03.05.2019, filed by J.L. against political
party, for justified.
2. On the grounds of art. 83, § 5, letter “a”, in connection with Art. 58, § 2, letter “i” of Regulation (EU) 2016/679 imposes on a political party with Bulstat ********** an administrative penalty - a property sanction in the amount of BGN 2,000 (two thousand levs) for processing the personal data of the complainant in violation of Art. 6, § 1 of the Regulation.
The decision is subject to appeal within 14 days of its service, through the Commission for Personal Data Protection, before the Administrative Court of Sofia - city.