BAC (Bulgaria) - № 6515

BAC (Bulgaria) - ВАС - № 6515
Court:	BAC (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 6(1)(a) GDPR Article 6(1)(b) GDPR Article 6(1)(c) GDPR Bulgarian Energy Act
Decided:	29.06.2022
Published:
Parties:
National Case Number/Name:	ВАС - № 6515
European Case Law Identifier:
Appeal from:	Administrative Court of Sofia-city 6611
Appeal to:	Not appealed
Original Language(s):	Bulgarian
Original Source:	Върховния административен съд (in Bulgarian)
Initial Contributor:	Marieta Gencheva

The Supreme Administrative Court of Bulgaria affirmed a ruling by the Administrative Court of Sofia awarding approximately €128 (250 BGN) each to two data subjects after a heating company retained a copy of their mortgage and presented it in court without a legal basis.

English Summary

Facts

The controller was Toplofikacia Sofia EAD, a heating company in Bulgaria. The data subjects were customers of the controller.

The controller submitted a copy of the data subjects' mortgage deed as evidence in a separate court procedure before the District Court of Sofia. The controller had obtained a copy of the document in the normal course of business with the data subjects. Bulgarian law required that the controller establish the property rights of its customers before executing a contract to supply heat.

The Administrative Court of Sofia found that the controller had processed data on the property and financial situation of the data subjects contained in the mortgage deed without a legal basis under Article 6 GDPR and ordered the controller to pay the data subjects €127.82 Euro (250 BGN) each as compensation for non-material damages.

The controller appealed the decision, taking the view that the lawful bases for processing the data subjects' personal data were "data subjects' consent," "neccessary for performance of a contract," and "necessary for compliance with a legal obligation," under Articles 6(1)(a), 6(1)(b), and 6(1)(c) GDPR respectively.

Holding

The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety.

First, the Court confirmed that the controller had processed the data subjects' personal data: The mortgage contained the data subjects' personal data because it contained their names as well as financial and property information (all relating to identified natural persons per Article 4(1) GDPR), and the controller processed that data initially by collecting it. The Court clarified that retaining the data and later producing it before a court were further processing that required a legal basis under Article 6.

Next, the Court acknowledged that the data subjects did in fact consent to the initial processing (collection) of their personal data, but it stressed that this consent extended only insofar as processing was necessary for the controller to verify ownership of the property and fulfill the contract. The data subjects did not consent to further processing, so Article 6(1)(a) did not a furnish a legal basis for the retention and distribution of the data after performance of the heating contract.

Similarly, the controller could not rely on Article 6(1)(b) as a legal basis for processing because it was not necessary to retain a copy of the data subject's mortgage, much less present that document in court, in order to provide heating services.

Finally, Article 6(1)(c) was not available as a legal basis because the processing was not necessary to comply with a legal obligation under the Bulgarian Energy Act nor any other law.

On appeal, the controller had not raised any arguments specifically regarding the compensation awarded for non-material damages caused by the unlawful processing. Still, the Court affirmed that there was a reasonable causal link between the unlawful acts of the controller and the damage suffered by the data subjects in the form of embarassment and anxiety as well as the possibility of further misuse.

Comment

The text of the Supreme Administrative Court decision does not mention the result of the court proceedings wherein the controller presented the data subjects' mortgage deed.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

  The proceedings are in accordance with Art. 208 et seq. of the Administrative Procedure Code (APC). Formed on a cassation appeal of "Toplofikatsia Sofia" EAD, through a legal representative, against decision No. 6611 of 11.11.2021. , decreed under adm. case No. 10954/2020 of the Administrative Court - Sofia - city, in its part, by which it was accepted that the processing of the data on property and financial status contained in a notarial deed for the establishment of a contractual mortgage of G. Atanasova and S. Atanasov was carried out in the absence on the grounds under Article 6 of Regulation 2016/679, and "Toplofikatsia Sofia" EAD was convicted of the claim with legal grounds under Article 79, paragraph 1 and Article 82, paragraph 1 of Regulation (EU) 2016/679 on European Parliament and of the Council of 27.04.2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC(GDPR) to pay G. Atanasova and S. Atanasov the amount of BGN 250 for each of them, representing compensation for non-pecuniary damage caused by the unlawful processing of their personal data, together with the legal interest on this amount, counted from the entry into force of the court decision until its final payment. The cassator maintains in the cassation appeal that the decision in the appealed part is incorrect - due to a violation of the substantive law, substantial violations of the procedural rules and unreasonableness, requests its cancellation, rejection of the claims for compensation and interest, award of legal fees, alternatively makes an objection of excessiveness of the attorney's fees claimed. The defendant in the cassation appeal - G. Atanasova does not express an opinion on the cassation appeal. The defendant - S. Atanasov, in a court session, expressed an opinion that the cassation appeal was groundless. The representative of the Supreme Administrative Prosecutor's Office gives a reasoned conclusion that the cassation appeal is groundless. The Supreme Administrative Court, fifth department, having assessed the admissibility of the cassation appeal and the annulment cassation grounds cited in it, according to Art. 209 of the APC, accepts the cassation appeal as procedurally admissible, as filed in time and by the proper party, but examined in substance as unfounded. With the disputed decision No. 6611 of 11.11.2021, issued under the adm. case No. 10954/2020 of the Administrative Court - Sofia - city, it was accepted that the processing of the data on property and financial status, which are contained in a notarial deed for the establishment of a contractual mortgage of G. Atanasova and S. Atanasov, was carried out in the absence of the grounds under Art. 6 of Regulation 2016/679, and "Toplofikatsia Sofia" EAD was convicted in the claim with legal grounds under Art. 79, par. 1 and Art. 82, par. 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/ EC (GDPR) to pay G. Atanasova and S. Atanasov the sum of 250 BGN for each one, representing compensation for non-pecuniary damage caused by the unlawful processing of their personal data, together with the legal interest on this amount, calculated from the entry into force of the court decision until its final payment. The Administrative Court accepted as established that the data on the property and financial status of the plaintiffs, which are contained in a notarial deed for the establishment of a contractual mortgage on the home, entered in the Registration Office under No. 78, Item XVII, Case No. 23687/2003. , presented by "Toplofikatsia Sofia" EAD before the Sofia District Court in case No. 56991/2019. was carried out without the existence of grounds under Article 6 of Regulation (EU) 2016/679 of the EP and of the Council, due to which the defendant committed a violation by unlawfully processing personal data through collection, storage and transmission/distribution. In view of this decisive legal conclusion, according to the ASSG, all the elements of the factual composition of art. 39, para. 2 of the GDPR for engaging the responsibility of the administrator of personal data and given the indisputably established unlawful processing of the plaintiffs' data, the court considered that it is normal for them to experience inconvenience, worry and uncertainty. Given the lack of committed evidence for the alleged non-pecuniary damages, the court has accepted that no greater damages than the natural anxiety that any person would feel in a similar situation can be proven. He considered that there is a direct cause and effect relationship between the illegal actions of the defendant and between the illegal result, as well as between it and the suffered non-pecuniary damages and according to Art. 52 of the ZZD, taking into account that the damages are expressed only in the usual mental distress awarded compensation in the amount of BGN 250. for each of the plaintiffs. The court decision rendered in this way is correct. The administrative court was referred to an admissible complaint and a claim for compensation, which contained allegations of unlawful processing of personal data with resulting damages, and the Commission was not referred to this issue for the protection of personal data. According to Art. 39, para. 1 of the Labor Code, in case of violation of his rights under this law, any natural person may appeal the actions and acts of the administrator in court before the relevant administrative court or before the Supreme Administrative Court under the general rules of jurisdiction. In this proceeding, the natural person can request compensation for the damages suffered by him as a result of unlawful processing of personal data by the administrator. In the absence of other rules, the claim should be examined by the administrative court with the corresponding application of the order of Art. 204 et seq. of the APC in connection with Art. 144 of the APC referring to the CPC. A condition for eligibility is only the absence of pending proceedings before the Personal Data Protection Commission (PCPD) for the same violation, its appealed decision regarding the same violation, or a court decision that has entered into force. In the present case, a certificate from the CPLD was presented to the ACSG, from which it was established that there were no proceedings before it on the same dispute, which also follows the absence of court proceedings on appeal of a decision of the CPLD. Based on the stated considerations, the current court panel finds that the ASSG correctly accepted the complaint for consideration and joined it with a claim for compensation as a court with generic and local competence to consider this dispute. The appealed court decision was rendered in a legal composition and after referral with a regular complaint and a claim. When examining the dispute before the first instance, no procedural violations were committed and the factual situation was correctly established based on all the evidence collected in the case. In a correctly established factual situation, the deciding court has substantiated correct legal conclusions, which are fully shared by the present instance. Correctly, the court of first instance, upon an overall assessment of the evidence collected in the case, as well as the arguments and objections of the parties, came to the conclusion that there was consent of the plaintiffs for the processing of their personal data: names, social security number, address and subscriber number contained in the documents , which were provided personally by the claimants to the personal data controller, and that there was no such consent in relation to the title document and notarial deed of contractual mortgage, but in relation to the title document he assumed that such consent was given by confirmation - connection to the heat transmission network, which is permissible only after establishing property rights on the property. The unlawful processing of the data of the plaintiffs G. Atanasova and S. Atanasov, which are contained in a notarial deed for a contractual mortgage, presented by the defendant in the civil case proceedings before the SRC, has been undisputedly established, since the defendant is not a party to the legal relationship and the mortgage of the property and these data are in no way related to the supply of heat energy. That is why the ASAG correctly assumed that there is no basis for processing this data under Art. 6, §1, b "b" of the Regulation - that the processing of the person's personal data is necessary for the performance of a contract under which the subject of data to be a party. The processing is unlawful. The assessor is an administrator of personal data and since it has been indisputably proven by the factual side an action on processing personal data in the sense of the legal definition of paragraph 1, item 1 of the Additional provisions of the LLPD in connection with art. 4, item 1 of the Regulation, which was found to have been carried out without the consent of the natural persons and in the absence of the grounds under Art. 6, § 1 of Regulation (EU) 2016/679, the same was correctly accepted as a violation. The objection in the cassation appeal for a violation of the substantive law admitted by the court of first instance is unfounded. Contrary to what the company claims, the personal data of G. Atanasova and S. Atanasov were illegally processed in violation of the norms of the Regulation, due to the lack of knowledge and consent on their part to provide a notarial deed for a contractual mortgage in the proceedings under city case No. 56991/2019. according to the inventory of the SRS, which was proven beyond dispute in the case. The complaint in the cassation appeal about the court's misinterpretation of the provisions of the Energy Act governing the sale of heat energy for domestic needs, as well as the nature of the legal relationship arising from public certain general conditions proposed by the heat transfer company and approved by KEVR, which is why the processing of personal data is legitimate, carried out on a legal basis, according to Article 6, paragraph 1, b "c" of Regulation (EU) 2016/679. These allegations were brought before the court of first instance, which reasoned and consistently discussed them and came to a lawful conclusion that the legal basis asserted by the defendant under Art. 6, para. 1, b. "c" of the Regulation is not available, since the processing of the data contained in a notarial deed for an established contractual mortgage, by providing them in a pending civil legal dispute, is not necessary to comply with a legal obligation of the defendant under the sales contract concluded between the parties of thermal energy in accordance with Article 150 of the Law on Energy. Pursuant to Art. 153 of the Law on Energy and for certification of the real property right of the claimants, it is sufficient to provide the document of ownership - contract for purchase - sale of real estate dated 14.01.2020. and the data contained therein certifying this right. That is why the court correctly accepted that there is no basis under Article 6, paragraph 1, b."c" of the Regulation that the processing of the data in the notarial deed is necessary to comply with a legal obligation of the data administrator under agreements between the parties contract for the supply of thermal energy. The cassation appeal lacks specific complaints regarding the awarded compensation for non-property damages caused by the unlawful processing of the plaintiffs' personal data, both on the basis and on their amount. Upon the verification of the court decision, the current instance accepts that in accordance with the evidence collected in the case and the logical connections between them, the existence of a direct causal link between the unlawful actions of the plaintiff and the unlawful result for the plaintiffs, experienced by them habitual damages expressed in concern and anxiety as a result of the information about their property and financial situation that has been disseminated and the possible misuse of this information. Reasonably and in accordance with the enduring jurisprudence in the field of tort, the ACSG holds that the experience of worry, anxiety and restlessness constitute non-pecuniary damages subject to compensation. The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (Charter/CFR) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of their personal data. The principles and rules regarding the protection of natural persons in relation to the processing of their personal data should, regardless of their citizenship or place of residence, be consistent with their fundamental rights and freedoms, and more specifically, with the right to the protection of their personal data. In this sense, any violation of a fundamental right must be considered particularly significant. Causing a feeling of alarm from the breached security of the protected asset (personal data) is sufficient to engage the responsibility of the person who has the duty to guarantee it and not allow violations of rights based on European law guaranteed. The present judicial panel finds that with the correct application of Art. 52 of the ZZD, the amount of compensation due has been determined, which is consistent with the circumstances of the anxiety and worry experienced by the plaintiffs, which is not above the usual amount and consistent with the standard of living in the country. the stated considerations and on the basis of Art. 221, para. 2, sentence two of the APC, the present judicial panel accepts that the appealed decision of the ASSG is valid, admissible and correct, as the grounds cited in the cassation appeal are not present, therefore it should be left in force. The decision states case number 10984/2020. of the ASSG, which is different from the actual number under which the case No. 10954/2020 was initiated. of the ASSG, but the current court finds that it is a technical error in writing the number, which does not constitute a cassation ground for annulment of the decision on this basis. The defendants in cassation have not claimed costs, which is why they should not be awarded, and in view of the outcome of the dispute, in favor of the cassator, they are not owed. For these reasons, the Supreme Administrative Court, fifth department, DECIDES: UPHOLD the decision No. 6611 of 11.11.2021 by adm. case No. 10954/2020 of the Administrative Court - Sofia - city. The DECISION is final and not subject to appeal.