CPDP (Bulgaria) - PNN-01-33/2022

CPDP - PNN-01-33/2022
Authority:	CPDP (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 32 GDPR
Type:	Complaint
Outcome:	Partly Upheld
Started:
Decided:	20.12.2022
Published:
Fine:	500 BGN
Parties:	n/a
National Case Number/Name:	PNN-01-33/2022
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Bulgarian
Original Source:	CPDP (in BG)
Initial Contributor:	n/a

The Bulgarian DPA fined a doctor BGN 500 (approx. €255) for a violation of Article 32 GDPR. The Doctor had allowed that her electronic signature was used to access the vaccination status of a member of the European Parliament. This information was later disclosed in a television programme.

English Summary

Facts

On 9 January 2022, the Bulgarian television program 'This Sunday' broadcasted a news report about the COVID-19 pandemic. The journalist presenting the programme, M.C, stated that the data subject, a member of the European Parliament, had been vaccinated against COVID-19 on 19 August 2021 with the 'Janssen Vaccine', despite the fact that he had publicly been opposed to vaccination and was against COVID-19 restriction measures. With regard to the journalistic source which provided the information, it was not entirely clear how the journalists were able to obtain the information about the vaccination status of the data subject.

The data subject filed a complaint at the Bulgarian DPA (date not disclosed) against the journalist 'M.C' and the media company 'Media EAD', which had broadcasted the report. He stated that this data had been disclosed without his consent and without his knowledge. There was therefore an unlawful access and dissemination of his personal data. The DPA also asked a doctor, who had supposedly accessed the data subject's vaccination status, to provide her side of the story. The doctor claimed that she had not accessed the vaccination status of the data subject, but someone else had used her electronic signature. She stated that other employees of the medical center could also have used her signature to access the vaccination status.

The medical center also took part in the proceedings. The clinic argued that three employees had access to the electronic signature of the doctor and could have accessed the vaccination status of the data subject: K.R., the head nurse, S.P., an employee of the human resources department and lastly, the doctor herself. According to the clinic, the head nurse was the one who recorded them in the electronic system using the doctor's signature. She was also the only one who had the electronic signature and the vaccination platform installed on her computer, which was located in her office.

The medical establishment concluded that the head nurse had abused her position.

Holding

First, the DPA held that the journalist, M.C, could not be regarded as a controller in this case. As a journalist/employee and presenter of the programme, she was a person under Article 29 GDPR. The DPA determined that the controllers in this case were the Doctor, M.M, and the media company, M. EAD. The DPA emphasised that they should be regarded as separate controller's, since there was no evidence that they jointly decided the means and purposes of the processing. Later in the decision, the DPA also determined that the medical establishment itself was a controller.

Second, the DPA confirmed that the information regarding the vaccination status of the data subject constituted health data in the context of Article 9 GDPR.

Third, the DPA assessed the processing conducted by the first controller, the media company, and stated that it was undisputed that this health data was disseminated for journalistic purposes. The Bulgarian DPA then referred to Article 1 of the Bulgarian PDPA, which stated that processing personal data is lawful when carried out for the purpose of freedom of expression. Pursuant to Article 25(h)(3) of this law, Article 9 GDPR does not apply to the processing of personal data for journalistic purposes. The DPA held that the information should be of real public importance to be considered information to be processed for the purpose of journalistic activity. To determine if the current dissemination of information was lawful, a balancing act had to be conducted between the protection of personal data and the freedom of expression. The principle of data minimization was also of importance here. In the present case, the DPA considered that there was a case of real public importance. The data subject was a public figure as a member of the European Parliament, and therefore enjoyed a lower level of protection of his personal data. Next, the DPA confirmed that Article 9 GDPR was not applicable here due to the national law. The DPA also confirmed that in this case, a balance had been struck between the freedom of expression and the right to data protection. Despite the fact that the disclosed data was health data and that this was processed without the knowledge and consent of the data subject, the DPA held that the processing was lawful. There was an overriding interest in the disclosure of this information, mainly because this showed that the data subject, who had been against vaccination and Covid measures in public, was vaccinated himself despite urging others to do the contrary. The information was also presented in broadcast about the pandemic situation and served as an expression of the public's right to receive truthful, complete and comprehensible information. The DPA also stated that the GDPR should not become a tool to manipulate the public and cover up the lies of the data subject. The processing was lawful and in accordance with Article 1 of the Bulgarian PDPA.

Fourth, the Bulgarian DPA assessed the conduct of the second controller, the doctor. It was undisputed that her signature was used to check the vaccination status of the data subject. It was issued to her in her personal capacity, and the internal medical establishment procedures did not require the doctor to give this signature to other employees, so there was no reason to provide the head nurse with her signature. In contrast with the media company, Article 9 GPDR was applicable for the controller's processing, which included health data. In this regard, the Bulgarian DPA determined that the controller had shown 'gross negligence' with respect to the storage and use of her personal signature, which had resulted in the unauthorised access to the health data of the data subject. The Doctor had not taken appropriate measures to ensure / to demonstrate that personal data was processed in a GDPR complaint way. The fact that this negligence concerned health data made the situation even worse. Since there were no measures implemented at all, the DPA determined that the doctor had violated Articles 32(1) and 32(2) GDPR.The DPA fined the doctor 500 Leva pursuant to Articles 83(4)(a) and 58(2)(i) GDPR.

Lastly, the DPA determined that the medical center, being the third and last controller, had also violated Article 32 GDPR. The facility had allowed the practice of using electronic signatures for the processing of sensitive health data and access to this data. On the date of the breach, this controller had not established appropriate technical and organisational measures for the processing of sensitive personal data, nor was the controller able to show that it processed data in accordance with the GDPR. Also, there was a lack of training and supervision, which resulted in the violation of Article 32 GDPR. Because the controller had already addressed some of the identified issues, the DPA warned this controller pursuant to Article 58(2)(b) GDPR.

Comment

To be updated

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

SOLUTION
No. PNN-01-33/2022. Sofia, 
20.12.2022
The Commission for Personal Data Protection (CPDP), composed of. 1 of the Personal Data 
Protection Act in conjunction with Article 57, § 1, point "f" of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the 
processing of personal data and on the free movement of such data (the Regulation, GDPR), examined 
the merits of complaint No. PPN-01-33/17.01.2022.
The administrative proceedings are under Article 38 of the Personal Data Protection Act (PDPA).
The Commission for Personal Data Protection was referred to the complaint PPN-01-33/17.01.2022, 
filed by N.D. against Media EAD (M. EAD) and M.C., in her capacity as a journalist at the media outlet, 
alleging unlawful access to a special category of personal data relating to his state of health and, in 
particular, his vaccination status, and their dissemination through a report in the television programme 
"This Weekend", broadcast on the air of the media outlet on 09.01.2022 at 09:30, repeated the same 
evening in the central news broadcast of the television outlet, at 19:00, as the first leading news item.
The complainant claims that in the course of the report the journalist M.C. "disclosed on air 
personal health data" of four MPs from the political party "V.", including his own, including: the date and 
the specific type of drug injected into the individuals. He is categorical that the data were disseminated 
without his knowledge and consent, and that there was no such consent with regard to the other three 
MPs.
Mr. N.D. claims that Ms. M.C. stated on air that she had access to "this type of health personal 
data of all MPs of the V. Party", and she also announced the exact number of persons with medical 
manipulations performed.
He considers that there has been unlawful access and dissemination of his personal data and asks 
the CPD to investigate the case and identify the original source of the information. He asks that, if the CPD 
considers it necessary, this information be addressed to the Public Prosecutor's Office and the relevant 
regulatory authorities. Asks for an injunction to 'immediately stop' the alleged infringement, insofar as 
the material was repeated repeatedly in the news broadcasts of the media on 09.01.2022 and 10.01.2022, 
and its use by the media, in various television programmes broadcast within its programme, continued as 
of 13.01.2022.
No evidence is attached to the complaint, a link to the material originally broadcast on the air of 
the media is provided.
Evidentiary motions were made: for the admission, for the purpose of giving explanations, of each 
of the four MPs whose personal data had been disseminated and for the request for explanations from 
M.C. as to the source of the information. The latter request made in the complaint is inadmissible under 
the provision of Article 25h(4) of the PDPA according to which "The exercise of the powers of the 
Commission under Article 58(4) of Regulation (EU) 2016/679 may not lead to the disclosure of the 
secrecy of the source of the information".
On 18.01.2022, in the interest of clarifying the actual facts relevant to the case, a screen print was 
made of the contents of the text file referred to in the complaint: https://btvnovinite.bg/predavania/tazi�sabota-i-nedelia/koi-sa-deputatite-koito-narichat-vaksinite- experimental-technost-a-vsashtnost-sa�imunizirani.html, and the text file posted to the link
KLD DECISIONS
CPC November - December 2022 35
A video file, lasting 14:53 minutes, has been downloaded on CD. The actions are documented in Protocol 
PPN-01-33#3/18.01.2022, with screen print and CD attached.
In the light of the principles of equality of arms and truthfulness, which are enshrined in the 
administrative procedure, M. EAD and Ms M.C., in her capacity as a journalist, were sent notification 
letters about the administrative proceedings initiated in the case, were given the opportunity to submit written 
statements on the allegations set out in the complaint and to submit relevant evidence.
Written submissions PPN-01-33#6/01.02.2022 and PPN-01- 33#7/01.02.2022 were 
submitted in response, expressed respectively by Ms M.C. and the company, with identical arguments 
for the unfoundedness of the complaint, insofar as the applicant is a public figure - a Member of Parliament, 
whose personal data has been processed for journalistic purposes on issues of public importance concerning 
the Covid-19 pandemic, the vaccination against Covid-19 and the "green certificate", on which the 
applicant has a clearly expressed and publicized position against vaccination and coercive measures to 
contain the Covid-19 pandemic. Relevant evidence is attached to support the allegations made in the 
submissions.
The Commission for Personal Data Protection is an independent state authority that protects 
individuals in the processing of their personal data and access to such data, as well as controls compliance 
with the PDPA and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 
2016 on the protection of natural persons with regard to the processing of personal data and on the free 
movement of such data.
In order to exercise its powers, the Commission must be validly addressed.
The complaint contains the mandatory requisites - there are details of the complainant - N.D., the 
nature of the request, the date and signature, the passively legitimated parties, as well as the date of 
knowledge of the infringement, in view of which it is regular. In this connection, it should be noted that, 
although the complaint alleges infringements by three other persons, in so far as they are not identified 
and the complaint does not bear their signatures and there is no evidence of any authorisation on their 
part in respect of Mr N.D., they do not have the status of complainants.
The subject-matter of the complaint are allegations of unlawful access to and dissemination of a 
special category of data relating to the applicant's state of health and, in particular, vaccination status. 
These, together with data relating to the applicant's full name and his capacity as a Member of the 
European Parliament, are personal data within the meaning of the GDPR, in so far as the person 
concerned can be undeniably identified
The complaint was lodged by an individual with a legal interest. It is undisputed that the processing of 
personal data according to the above-mentioned legal definition is at issue, and that the passively 
legitimated party M. EAD is a controller of personal data as defined in Article 4(7) of Regulation (EU) 
2016/679, as it defines the purposes of the processing - the presentation of information of public interest 
in a television broadcast, and the means of the processing - by broadcasting reports and programmes on 
the air of the media. By virtue of Article 58 of Regulation (EU) 2016/679, which defines the powers of 
the supervisory authority, the Regulation and the PDPA respectively are only applicable to controllers and 
processors. The analysis of this provision, in accordance with the purpose of the PDPA, leads to the 
conclusion that in order for the Commission to exercise its rights, the violations of the subject's rights 
must have been committed by the controller or processor and the complaint must be directed against the 
latter, who in that capacity have violated the rights of the individual. In this regard, it should be noted that 
the journalist and presenter of the programme, M.C., as an employee of the media and in her capacity as 
presenter of the programme broadcast on the air of the media, does not have the capacity of an 
administrator or processor of personal data, since she processes personal data in the performance of her 
official duties, i.e. she is a person under Article 29 of the Regulation and acts under the authority of the 
controller and in practice "engages" him in his processing activities, in so far as she actually
KLD DECISIONS
CPC November - December 2022 36
carried out, as host of the transmission, the processing activities alleged to have infringed the rights of the 
applicant.
The Commission was seized on 13.01.2022, only two days after the alleged violation took place, which 
leads to the conclusion that the complaint was filed within the time limit under Art. 1 of the PDPA. The 
competent authority - the CPCL - was seized of the matter, which, pursuant to its powers under Art. 1 of 
the PDPA in conjunction with Article 57, § 1, point "f" of Regulation (EU) 2016/679, examines 
complaints against acts and actions of personal data controllers that violate the rights of data subjects 
related to the processing of personal data, as there are no exceptions under Art. 2(2)(c) and Article 55(3) 
of the Regulation, given that the case does not concern processing activities carried out by an individual 
in the course of purely personal or domestic activities and/or activities carried out by the courts in the 
exercise of their judicial functions.
For the above reasons and in the absence of the negative prerequisites under Article 27, paragraph 
2 of the APC, at a meeting of the Commission held on 19.01.2022, the appeal was declared admissible 
and the following were constituted as parties to the proceedings: the appellant - N.D., the respondent M. 
EAD, in its capacity as a personal data controller, and the interested party M.C., in her capacity as a 
journalist in the media and presenter of the programme in question. An open hearing on the merits of the 
appeal has been scheduled for 16.03.2022 at 13:00, of which the parties have been duly notified. In order 
to clarify the facts of the case, the Ministry of Health and the I.O. Inc. have requested information and 
log files on the access to the vaccination status of the complainant from the date of his vaccination 
against COVID-19 until 09.01.2022, the date of the report, as well as specific information whether the 
complainant was vaccinated against COVID-19 and when, in order to assess whether the information 
given in the media broadcast corresponds to reality.
The requested information and evidence had not been provided by the date of the scheduled 
public hearing, therefore the substantive hearing of the appeal was adjourned to 04/05/2022.
In the course of the proceedings before the CPD, a cover letter with reference No. PPN-01-
33#19/21.03.2022 from I.O. Inc. informed that "N.D. was vaccinated against COVID-19 on 19.08.0221. 
Between the date of vaccination and 09.01.2022, N.D.'s vaccination status records were reviewed on 
06.01.2022 and 07.01.2022 by Dr. M.M."
Certified copy of the submission by I.O. AD was provided to the parties to the proceedings for their 
perusal, and the applicant was specifically requested to clarify whether he knew Dr M.M. and to specify 
whether he was his personal and/or treating physician.
In response, and by letter No. PPN-01-33#23/01.04.2022, the complainant responded in the 
negative to the inquiry from the CPD - he did not know Dr. M.M., nor was he his personal and/or 
attending physician.
In view of the foregoing and on the basis of Article 9(2) (principle of ex officio jurisdiction) and Article 
7 (principle of truthfulness) of the Code of Civil Procedure, in view of the evidence collected ex officio on 
the file and the subject-matter of the complaint, which also contains allegations of unlawful access to the 
applicant's health status, the Commission, by a decision taken at a meeting held on 06-07.04.2022, 
constituted, ex officio, Dr M.M. as a respondent in the proceedings, in her capacity as a personal data 
controller.
A public hearing on the merits of the appeal has been scheduled for 04/05/2022 by
13.00 in the administrative building of the CPD in the town of. Sofia, bul. "Proff. 2, Meeting Hall, 4th 
floor.
In order to clarify the facts of the case, I.O. AD, information was requested regarding the 
identifier through which Dr. M.M. accessed the complainant's vaccination status data, clarification of 
what data is visualized and available to the service user when "viewing" the person's vaccination status, 
and what the access channel used by Dr. M.M. was for the review of Mr. N.D.'s vaccination status data 
performed on 06.01.2022 and 07.01.2022.
KLD DECISIONS
CPC November - December 2022 37
In response and by letter PPN-01-33#33/26.04.2022, the requested information was provided. It is 
specifically stated by I.O. Inc. that the data that is displayed and available to the service user Dr. M.M. 
when "reviewing" Mr. N.D.'s vaccination status is: date of immunization record, national immunization 
reference number, dose sequence, date of next vaccine and availability of certificate. It is specified that the 
access channel to the data is immune.his.bg, the login to the system is done by a qualified electronic 
signature, after checking whether the doctor concerned has an active registration with the Bulgarian 
Medical Association.
In the course of the proceedings, a written opinion PPN-01-33#34/29.04.2022 on the merits of the 
dispute, in the part concerning the processing of data for journalistic purposes and the disclosure of the 
source of information, was received electronically, without an electronic signature. It is stated that the 
opinion comes from the Association of European Journalists - Bulgaria, without the signature of a 
specific person. The Association is not a party to the proceedings, in view of which the Commission for 
the Protection of Personal Data considers the submitted opinion to be irrelevant and should not be 
commented on in the grounds of the decision, leaving unclear how the Association was informed about 
the case, which it comments on in detail concerning the vaccination status and the quality of the applicant 
as a Member of the European Parliament.
On 04.05.2022, the CPLC received a request from the appellant to postpone the public hearing on 
the appeal scheduled for the same date due to work commitments and inability to attend the hearing.
On the basis of the application filed and due to the defendant Dr. M.M. not being properly notified 
of the proceedings, the hearing of the substantive appeal scheduled for 04.05.2022 was adjourned to 
22.06.2022 at 13:00 hours, of which the parties were duly notified. Notwithstanding the opportunity given 
to Dr. M.M. to be heard on the matter and the express directions that she should furnish information and 
evidence as to the basis of her access to the complainant's health/vaccination status regarding Covid-19 
on 06.01.2022 and 07.01.2022 and attach any other relevant evidence in the matter, no such evidence 
was adduced. Till 21.06.2022, a day before the scheduled public hearing to consider the merits of the 
complaint, there is no procedural activity by the respondent, the complaint has not been contested, no 
evidence or even allegations have been adduced on the subject matter of the dispute with which the 
CPWD is being referred.
In the course of the proceedings, by letter PPN-01-121/15.02.2022, the CEM informed that it had 
been informed of complaints filed by N.D. and V.M. regarding the publication of personal data of MPs in 
a journalistic investigation disseminated in the media programme of the media service provider M. EAD. 
They point out that the CEM considered at its meeting a report on the compliance of the broadcast with the 
provisions of the Broadcasting Act, in particular: with the norms relating to guaranteeing the right of 
citizens to information with the degree of protection of their privacy of public figures with influence in 
society. They inform that the CJM held that there was no violation of the RTI Act insofar as the 
journalistic audio-visual material contributed to the development of public dialogue on health policy and 
the accountability of democratically elected figures to their constituents.
A public meeting of the Board was held on June 22, 2022 to consider the merits of the appeal.
The appellant N.D. - duly notified, did not appear and was not represented at the hearing before 
the Committee.
The defendant, M.C., duly notified, did not appear and was not represented. For M. 
EAD, legal adviser B.G. appeared with power of attorney on file.
The defendant, Dr M.M., was represented by lawyer. A., with power of attorney submitted at the 
hearing.
KLD DECISIONS
CPC November - December 2022 38
The legal representatives of M. EAD and Dr M.M. contest the appeal. They do not adduce any 
new evidence. The procedural representative of the media maintains the written opinion expressed in the 
course of the proceedings that the complaint is unfounded.
Attorney A. asserted that her confidant, Dr. M.M., did not access the complainant's personal 
information regarding his vaccination status on 06/01/2022 and 07/01/2022. She alleged that Dr. M.M. 
did not personally use her electronic signature until 31.05.2022 and clarified that the electronic signatures 
of all the doctors at SCC, including her confidante's electronic signature, were used by the centre's 
employee, S.P. He adds that "five years ago, these electronic signatures of the doctors of the DCC were 
kept with the employee, S.P., who was in charge of Human Resources." She kept them and she sent the 
information to all the doctors of the DCC by the 4th of the month to the NHIF - who was served, what 
expenses, what the NHIF needed to remit to them. To make it easy for her, she has put one PIN on all the 
electronic signatures - on all the doctors, on all the electronic cards.
Having sent this data to the NHIS, since Dr. M.M. is the only one who is a physician at the SCC, 
and a physician at the hospital where she heads the internal medicine department, she herself is a 
specialist cardiologist, and since in the vaccination that is organized by this internal medicine department, 
all the certificates that are issued to the vaccinated persons are issued with the electronic signature of 
M.M..
So after S.P. is done with the reports, she hands over the electronic signature to the head nurse at C.R. 
Hospital, who puts the electronic signature on her computer, doesn't take it out at all, and it stays on day 
and night so it's easy for her, so she doesn't waste time...."
In order to prove the latter, he asks that two witnesses - S.P. and K.R. - be admitted to cross�examination. He asks the Commission to admit a technical expert from an IT specialist in order to 
establish "from which IP address, from which computer all this information was downloaded".
Advocate A. informed that the case was also the subject of case No. ***/2022 of the District 
Prosecutor's Office - Pazardzhik.
In view of the submissions made by the representative of Dr. M.M., by the decision of the open 
meeting of the Committee held on 22.06.2022, the State Medical Centre was also made a respondent in 
the proceedings. A fresh public hearing on the merits of the appeal has been scheduled for 14.09.2022 at 
13:00 hrs, of which the parties have been duly notified.
The SCC was informed of the proceedings, given the opportunity to comment on the case and to 
submit relevant evidence.
At the request of the procedural representative of the defendant M.M., two witnesses - S.P. and 
K.R. - were admitted to examination by deposition in the public hearing scheduled for 14.09.2022. 
Information has been requested on the case file No. ***/2022 of the District Prosecutor's Office -
Pazardzhik, namely on the subject of the case file, its movement and results, and in the hypothesis of the 
evidence collected in the case file on the access of personal data of the applicant on 06-07.01.2022. and 
the use of the relevant electronic signature, respectively information received in the case file in this regard 
from Dr. M.M. (defendant in the proceedings before the CPDL) or other persons, including S.P. and K.R. 
(called as witnesses in the proceedings before the CPDL), a copy of the same. As of 12.09.2022, the 
requested information has not been provided.
In order to clarify the case from the factual side, evidence and information have been requested 
from a third party not participating in the proceedings - Borika AD - the issuer of the electronic signature 
of Dr. M.M., in particular: how many and what carriers and when was the respective electronic signature 
issued?, Who and when received the electronic signature and the respective carriers?, Are the carriers 
active as of 06 and 07.01.2022? From which IP address is the electronic signature normally used and 
specifically from which IP address was it used on 01.06.2022 at 08:48 and on 01.07.2022 at 07:27?
In response, Borika AD informed that the company had issued to M.M. M. Bricka as follows:
KLD DECISIONS
CPC November - December 2022 39
1. Serial No. *** with author and holder M.M., with author and holder ID ****, valid from 
01.10.2016 to 03.10.2017 and from 02.10.2017 to 02.10.2018;
2. Serial No. *** with author and holder M.M., with author and holder ID****, valid as follows 
from 25.09.2018 to 25.09.2019, from 25.09.2019 to 24.09.2020, from 23.09.2020 to 23.09.2021 and from 
24.09.2021 to 24.09.2022.
The company clarified that the certificate for the CEP was issued on a B-trust smart card and was 
received by the holder's proxy. They add that the renewal of the certificate on 24.09.2021 was done online -
without the physical presence of the holder of the CEP in the office of the certification service provider. 
They point out that the company does not receive information on the IP addresses from which the CEP 
certificates are used. In support of their claims, they attach a certified copy of the certification services 
contract No **** of 03.10.2016, with a copy of the identity card, the acceptance report and the request No 
****/03.10.2016 for the issuance of an electronic signature.
In the course of the proceedings, an opinion PPN-01-33#57/12.09.2022 was issued by the SCC on 
the unfoundedness of the complaint, arguing that the company had taken the necessary measures to limit 
and prevent the misuse of personal data and documents.
They state that three employees of the company had access to Dr. M.M.'s electronic signature -
S.P. - an employee of the Human Resources Department, K.R. - the head nurse at the medical institution and 
Dr. M.M. They added that due to a requirement of the NHIF and in order to facilitate the work of the 
physicians at the facility, Ms. S.P., with the knowledge and permission of the physicians, submitted
monthly reports, between the 1st-5th of each month, to the NHIF for the work they performed.
They point out that during the pandemic period, the hospital was instructed by the RHC to open a 
vaccination office and to register an electronic signature for the submission of data on vaccinations carried 
out on the premises of the hospital, and that the signature of Dr. They informed that in the process, the 
company has appointed the head nurse K.R. to report the vaccinations done in the MH platform using Dr. 
M.M.'s signature.
They alleged that on 05/01/2022, after the report was submitted to the NHSO's POC, Ms. S.P. 
gave the signature to the head nurse, K.R., and after that date the signature was with K.R. so that she 
could continue to update the vaccination information and green certificates issued. They alleged that
"Dr. M.M.'s e-signature and the vaccine platform link are installed solely on Chief Nurse K.R.'s 
computer," as "The computer on which K.R. works is located in her office, which only she has access to."
They stated that the applicant was not a patient of the medical institution, had not undergone any 
medical examinations or manipulations at the medical institution and that the latter did not process his 
personal data. They state that 'for security purposes, all workstations in the medical establishment have 
static IP addresses, but when a workstation accesses a page on the Internet the traffic goes through the 
company's router and exits from the external IP address ****', therefore 'even if he is enrolled in I.O. Inc. 
the IP address from where the information was accessed will only show the external IP, not the internal 
IP of the computer itself."
They inform that after doing an "analysis of K.R.'s computer" they found no information on 
events, history or files for the relevant dates 06-07.01.2022 due to the longer period of time - more than 7 
months. Regarding the allegations of the legal representative of Dr. M.M. about a hacker attack, they 
point out that after checking and analyzing the entire information network and infrastructure of the 
company, they found no traces of such in the logs or installed malware. They consider that Ms. K.R. 
abused her position, acted unlawfully and intentionally, and in no way complied with the rules and 
policies put in place by the company regarding the protection of personal data and the application of the 
GDPR, and for those her
KLD DECISIONS
CPC November - December 2022 40
actions the company is not liable. In view of the violation found, they point out that the medical institution 
has "taken actions to correct the way of working in the company and to introduce additional rules and 
norms in order to ensure the confidentiality of personal data obtained in the process of work, including 
their non-disclosure", a training and instruction program has been prepared for all employees of the 
company on the application of the GDPR and the newly introduced rules by the medical institution, part 
of the changes concern the use of electronic signatures, namely: "All personal electronic signatures The 
submission of monthly activity reports with an electronic signature is carried out as follows: the person 
who owns the signature personally provides it to a member of the administration, personally enters the 
security password (pin code) and the report is submitted to the NHIF by a member of the administration 
in his presence. After submission of the report, the signature owner shall collect it. In this way, the 
electronic signature is under constant control and monitoring of the owner. Assisting with the filing of the 
report by an administrative officer in the presence of the owner of the electronic signature is optional and 
to facilitate the work of physicians. At the discretion of the physician, the physician may file the monthly 
report independently."
In conclusion, they inform that the employment relationship between the hospital and Ms K.R. is 
terminated as of 31.08.2022. They find the complaint unfounded as regards the establishment and the 
allegations to the contrary made by Dr M.M.'s legal representative unsubstantiated.
A further public hearing was held on 14.09.2022 to consider the merits of the appeal, of which the 
parties were duly notified.
The appellant N.D. - duly notified, did not appear and was not represented at the hearing before 
the Committee.
Defendant M. EAD is represented by legal advisor B.G. with power of attorney on file. The 
defendant Dr M.M. was represented by lawyer. A. with power of attorney on file.
SCC is represented by Atty. J.N. with a power of attorney presented at the hearing.
The correct name of the legal entity constituted and duly notified of the meeting, the DCC, was 
clarified at the meeting.
The defendants' representatives contest the appeal. They point to no new evidence.
Adv. A. does not support the request for the admission of S.P. as a witness.
At the request of the legal representatives of M. EAD and Dr. M.M., the examination of the 
appeal on its merits was postponed to the next meeting of the CPDL on 23.11.2022, for the attorneys' 
acquaintance. A. and legal counsel B.G. with the evidence newly collected by the CPPLD.
To clarify the case from the factual side, I.O. JSC, information was requested and in response by letter 
PPN- 01-33#69 dated 06.10.2022, that the IP address from which the vaccination status of the complainant 
was accessed on 06.01.2022 and 07.01.2022 was ****.
In the course of the proceedings, the District Prosecutor's Office - Pazardzhik replied that the pre�trial proceedings initiated in the case ***/2022 according to the inventory of the Regional Prosecutor's 
Office of the Ministry of Interior - Pazardzhik "is in its initial stage", therefore it is not possible to 
provide information on specific facts established in it.
By covering letter PPN-01-33#68 dated 29.09.2022, additional representation and relevant 
evidence, namely, certified copy of Order No. 2 dated 04.01.2021 and payment order dated 20.09.2021 
have been submitted by the DCC. In the opinion, the company has stated that "to assist its employees, the 
hospital is working towards easing some of the commitments of the
KLD DECISIONS
CPC November - December 2022 41
physicians," and one of the bases of assistance the company has undertaken is assisting with the 
application for the issuance and renewal of electronic signatures of pre-hospital physicians and "not least 
with the submission of monthly reports of pre-hospital physicians in the IPS to the NHIS." They specify 
that the submission of reports is regulated by an internal order, "with an employee of the company's 
administration assisting the doctors technically in submitting the reports", but only if the doctor wishes, 
who voluntarily provides his/her electronic signature to the employee. "They add that the medical 
establishment strives to provide all technical assistance to the medical staff, and every action taken by the 
company is to facilitate the work process, and the services offered are free of charge and have no binding
At a public hearing of the CPD held on 23.11.2022, the complaint was considered on its merits. The 
appellant N.D. - duly notified, did not appear, did not represent himself.
M.C. - duly notified, did not appear, was not represented.
The defendant M. EAD - regularly notified, was represented by legal adviser B.G. Defendant 
M.M. - regularly notified, represented by lawyer. А.
The defendant DCC - regularly notified, was represented by counsel. J.N.
Counsel for the defendants individually contest the appeal. They do not adduce any new evidence 
and have no requests for evidence. Adv. A. does not support the request for examination of a witness, stating 
that Ms K.R. also refused to testify.
Counsel for the respondents maintain the pleadings filed in the course of the proceedings that the 
appeal is unfounded and request the Commission to uphold the appeal against the respondents.
Counsel B.G. added that the television journalist M.C. had put forward data concerning the 
complainant N.D., but that this data was entirely in the context of the most topical public issue at the 
time, namely the Kovid epidemic, vaccination and the commitment of the political party "V." and the 
political slogan branding vaccines as experimental with an appeal to their constituents not to vaccinate 
them. It is submitted that the personal example of each member of a political party, including the 
applicant, is determinative of the health of the electorate and of society in general. In that regard, he 
considers that it is undoubtedly incumbent on both the media and the journalist to make the information 
relating to the official position of the political party 'B.' known to viewers and to the public, because the 
comparison between an official position and actual conduct is very important to make and to inform 
people what the true position of each member of that political party actually is.
Adv. A. reiterates the allegations that the electronic signature was not in the possession of Dr. 
M.M., and therefore considers that the complaint is unfounded with regard to her confidant, since the 
alleged violation could not have been committed by her.
In its capacity as an administrative authority and in relation to the need to establish the truth of 
the case, as a fundamental principle in administrative proceedings, pursuant to Article 7 of the APC, 
requiring the existence of established facts and taking into account the evidence gathered and the 
allegations made, the Commission finds that, examined on its merits, the complaint No. EAD and well 
founded in respect of Dr. M.M. and the DCC.
The subject-matter of the complaint are allegations of unlawful access to and dissemination of a
special category of data relating to the applicant's state of health and, in particular, his vaccination status, 
as identified by his name and his position as a Member of the European Parliament.
KLD DECISIONS
CPC November - December 2022 42
The data controllers in the present case are Dr M.M., with regard to access to the applicant's health 
and, in particular, vaccination status, and M. M.M. EAD, with regard to the dissemination of special 
category data relating to the applicant's state of health and, in particular, vaccination status. The 
Commission does not seek to establish a causal link between the two processing hypotheses, since the 
sources of the information are protected, and therefore Dr M.M. and M. EAD should be regarded as 
separate data controllers, in so far as there is no evidence that they jointly determined the purposes and 
means of the processing.
The procedural actions undertaken by the CPDL, including the ex officio collection of evidence, 
concern the clarification of the case from the factual side, the obligations of the administrative authority 
arising from the APC, concerning the subject of the dispute - unlawful access and dissemination of 
personal data concerning the vaccination status of the complainant. Ms M.C. was not required to disclose 
her journalistic sources of information in relation to the broadcast report, nor was such information requested 
from the other participants in the administrative proceedings.
regarding M. EAD:
From the evidence collected in the case file it is established, and it is not disputed between the 
parties in the proceedings, that on 09.01.2022 in the programme "This Sunday", broadcast on the air of 
M. TV, journalistic material was presented - a report with a subsequent commentary by a guest in the 
studio, which referred to the topic of the pandemic Covid-19 and the issues of the attitude towards: 1) 
vaccination and those vaccinated for Covid-19; 2) the anti-epidemic measures taken by the state in 
connection with the pandemic Covid-19; 3) the imminent introduction of restrictive measures on 
admission to the building of the National Assembly, after the presentation of item No. Green Certificate; 
and 4) an upcoming protest against the Green Certificate, organized by the parliamentary political party 
"V.", on 12.01.2022.
It is evident from the content of the report that the reporter and author of the programme, M.C., 
reported that the complainant N.D. was vaccinated against Covid-19 on 19 August 2021 with a vaccine 
from Janssen. The statement was made on the sidelines of the SC in an interview with the MP N.D. 
himself. The interview was dated 07.01.2022 and was broadcast two days later on the programme "This 
Sunday" on 09.01.2022 and distributed on the air of the media BTV.
The interview contained information related to the complainant's health and specifically 
vaccination status, specifically that the person was vaccinated against Covid-19 on August 19, 2021, 
with a vaccine from Janssen. The data on the applicant's vaccination status, taken together with the data 
contained in the material on the applicant's name, image and position held - Member of the European 
Parliament - are undeniably personal data within the meaning of the GDPR, in so far as the person can be 
undeniably identified. The same should qualify as a special category of data within the meaning of 
Article 9 of the GDPR, in so far as it relates to the person's state of health - 'personal data relating to the 
physical or mental state of the person, including the provision of health services, which provide 
information about his state of health' (Article 4(15) of the GDPR).
According to Recital 35 of the GDPR, personal data concerning the health of a data subject 
should cover any information relating to his or her physical or mental state of health in the past, present 
or future. Moreover, at the national level, the Health Act (HPA) defines 'health information' as personal 
data relating to the health, physical or mental development of individuals, as well as any other information 
contained in medical prescriptions, prescriptions, reports, certificates or other medical documentation. In 
this sense, as the Commission has already had the opportunity to rule in Opinion PNMD-01-12/2022, the 
set of all data contained in
KLD DECISIONS
CPC November - December 2022 43
certificate issued in connection with a vaccination against Covid-19, including the vaccination itself and the 
date of vaccination, as well as the vaccinated product itself, and may be disclosed directly or indirectly 
through it, fall within the scope of the term "health data" within the meaning of the GDPR and, in 
particular, "health information" within the meaning of the HIPAA.
In view of the content, nature and periodicity of the programme, as well as its dissemination and 
access, it is undisputed that the information was disseminated for journalistic purposes in connection with a 
journalistic investigation disseminated in the programme of the media service provider M. EAD. This is 
an act of processing personal data within the meaning of Article 4(2) of Regulation No 2016/679, in so 
far as, by means of the reportage and transmission at issue, the applicant's personal data were accessible 
and disseminated to an unlimited number of viewers of the media.
By argument of Art. 1 of the PDPA, the processing of personal data for journalistic purposes is 
lawful when carried out for the exercise of freedom of expression and the right to information, while 
respecting privacy. In this respect, the provision of Article 9 of the GDPR concerning the processing of 
special categories of personal data, including those relating to health status, are inapplicable by virtue of 
Article 25h, para. 3 of the PDPA according to which Articles 6, 9, 10, 30, 34 and Chapter 5 of the GDPR do 
not apply to the processing of personal data for journalistic purposes.
According to Recital 4 of Regulation (EU) 2016/679, the right to the protection of personal data 
must be considered in relation to its functions in society and in balance with other fundamental rights, 
such as freedom of expression and freedom of information, in accordance with the principle of 
proportionality, insofar as the right to the protection of personal data is not an absolute right, nor is the 
right to freedom of expression and freedom of information (Article 11 of the EU Charter of Fundamental 
Rights).
The term "journalistic purposes" is not defined by the legislator, but has been extensively 
considered and interpreted in case law. Essential to journalistic activity is the collection, analysis, 
interpretation and dissemination through the mass media of relevant and socially significant information. 
All journalistic activity is a manifestation of freedom of expression in a state governed by the rule of law, 
and restrictions on freedom of expression and information are permissible only to the extent necessary in a 
democratic society under Article 10 § 2 of the European Convention for the Protection of Human Rights 
and Fundamental Freedoms.
Starting from the concept of journalism as the practice of collecting, analyzing and interpreting 
information about current events, topics, phenomena, personalities and trends of contemporary life, 
presented in different genres and forms and disseminated to a mass audience, the conclusion is that it 
concerns the processing of personal data for journalistic purposes. By its nature, journalistic activity 
requires the dissemination of information on matters of public interest. The public dissemination of 
information for these purposes is a journalistic activity, since the very act of dissemination is an expression 
of opinion, view, judgment of the public information and its relevance to the interests of society. In order to 
process information for the purposes of journalistic activity, the information must concern matters of 
value which, in the light of the relations concerned, are of real public importance. In assessing the 
balance between the two competing rights, it is the principle of 'data minimisation' that is relevant - the 
personal data processed should be relevant, related to and limited to what is necessary in relation to the 
purposes for which it is processed, with the specific case of satisfying the public interest. Journalistic 
purposes by definition include the exercise of the right to information and freedom of expression. 
Restrictions on freedom of expression and information are only permissible to the extent necessary in a 
democratic society under Article 10(2) ECHR. By its very nature, journalistic activity requires the 
dissemination of information on matters of public interest. The publication of a report in a media broadcast 
constitutes public disclosure. The public dissemination of information for these purposes is journalistic
KLD DECISIONS
CPC November - December 2022 44
activity, since the very fact of dissemination is an expression of opinion, view, judgment of public 
information and its importance for the interests of society. In order for information to be processed for the 
purposes of journalistic activity, the information must concern matters of value which, in the light of the 
relations concerned, are of real public importance, as is the case here.
In the present case, it is indisputable that the data subject is a public figure - a Member of 
Parliament, and as such enjoys a lower level of protection of his personal data, but only and insofar as 
they are relevant and related to the functions exercised by him as a Member of Parliament and the 
positions he expresses as such and in this capacity to his constituents. It is undisputed that the personal 
data concerning the applicant's state of health as regards the vaccination against Covid-19 were 
disseminated by the media without his knowledge or consent. There is no evidence that they were made 
public by the complainant or the health authorities, but the same is irrelevant in so far as the provisions of 
Article 9 of the GDPR are inapplicable in the present case.
Public figures have a lower threshold of protection of their privacy, but interference with it is only 
permissible when there is a balance between the right to protection of privacy and the right to freedom of 
expression and information. In the present case, however, a balance has been struck. Sensitive health 
information within the meaning of the Health Act has been disclosed, namely personal data relating to the 
health, physical and mental development of the individual, as well as information relating to the individual 
contained in medical examinations, prescriptions, certificates and other medical documentation. The 
information has been disclosed and disseminated by a media outlet that is outside the scope of the persons 
entitled to process the personal data of citizens relating to their state of health as defined by the Health Act
- medical and health care institutions, state bodies competent in the field of health care and health 
insurance and relevant medical professionals.
The evidence gathered in the file and the factual situation clarified lead to the conclusion that there is 
an overriding public interest in the disclosure of the information, given the right of the public to be 
informed and the categorical position stated and promoted by the complainant against vaccination against 
Covid-19 and green certificates, which does not correspond with the actions of the MP, who was vaccinated 
on a date prior to his statements as an MP, despite urging and agitating persons to the contrary, claiming that 
vaccines "are ex
The information relates to a public figure and is necessary for the performance of a task in the public 
interest in so far as that interest would not be served without disclosure of the data. The journalistic 
material has been prepared and broadcast in a pandemic situation in which the contribution of the media 
is to provide a platform for active discussion and debate of the issue, actively seeking and clarifying 
different, including contradictory, opinions and positions, presenting the arguments of particular groups 
in society, with the emphasis on the truth, disclosure and exposition of a real factual situation, as an 
expression of the public's right to receive truthful, complete and comprehensible information to help it 
make an informed and reasonable judgement based on
The report reveals the publicly expressed opinion and statement of the complainant, not in his 
personal capacity, but as a Member of Parliament with influence and authority with the electorate, on the 
nature of the pandemic and his opposition, as a public figure, to the measures taken by the State to deal 
with the pandemic, but at the same time exercising personal conduct that is inconsistent with the publicly 
expressed opposition. In this respect, the defendant's observations can be shared. EAD that the display of 
a contradiction between conduct and publicly expressed opinion is subject to the exercise of civil control 
by the mass media for the purpose of public awareness and debate on an undeniably publicly significant
KLD DECISIONS
CPC November - December 2022 45
Topic. And while the GDPR is designed to protect the privacy of individuals, it cannot and should not be 
used as a tool to manipulate the public and cover up behaviour, such as the untruths spoken by a public 
figure on public health issues.
In the instant case, in balancing two competing rights in a pandemic setting, the disclosure of the 
individual's health status by the media was in accordance with s. 25h of the PIPEDA insofar as it was 
relevant and related to ensuring the public's right to information with the degree of protection of the 
privacy of public figures and their influence in society. Similar to the CJM's perception, it can be 
concluded that journalistic audio-visual material contributes to the development of public dialogue on health 
care policy and the accountability of democratically elected figures to their constituents, and in the 
context of Article 25h of the GDPR, is carried out in fulfilment of the public's right to information to 
information of public importance.
This is also the long-standing case-law and practice of the ECtHR. The opinion of a certain 
category of persons - public figures such as the applicant - expressed in public contributes to the 
formation of a definition of the attitudes of society as a whole, as well as influencing the choices of the 
majority of citizens, including with regard to the right to make an informed decision on vaccination. It is 
because of this specific public position and influence of these individuals that they should be subject to 
more intense public criticism in order to ensure the public's right to seek and receive accurate and truthful 
information on issues of importance to society, which in a pandemic context is undoubtedly the issue of 
vaccination against Covid-19. The public has the right to be informed of the actions and deeds of these 
individuals so that every citizen can form an opinion about the individual and the positions they express in 
the context of the actual and factual actions that contradict them.
In the ECtHR's decision in the case of Katya Kasabova and Bozhidar Bozhkov v. Bulgaria 
concerning a sanction decision against journalists for reporting on a long-established corrupt practice in 
admissions to elite high schools in the city of Sofia. The ECtHR court stressed that too strict an attitude 
towards the professional conduct of journalists could lead to the frustration of their obligations to inform 
the public and concluded that the Bulgarian court's interference in their right to expression was not 
"necessary in a democratic society".
The ECtHR's decision in Yordanov and Toshev (journalists) v. Bulgaria is similar. Upholding the 
opinion expressed above in Kasabova and Bozhkov v. Bulgaria, the Court adds that in seeking the right 
balance between the protection of freedom of expression enshrined in Article 10 and the protection of the 
reputation of the persons against whom the accusations are made, which is one aspect of the right to 
privacy protected by Article 8 of the Convention, the vital role of a "public watchdog" that the press plays 
in a democratic society is of particular importance. While it must not overstep certain boundaries, in 
particular with regard to the reputation and rights of others, it has a duty - in a manner consistent with its 
duties and responsibilities - to convey information and ideas on political and other matters of public 
concern. The Court stresses that "the sanctions imposed by the national authorities are capable of deterring 
the press from engaging in debate on matters of legitimate public interest" and revealing the truth. 
Moreover, the Court links the freedom to disseminate information to the right of everyone and of society 
as a whole to be informed and emphasizes the duty of the media to provide information on matters of 
public interest. (See also in this sense the Decision of the CC of the Republic of Bulgaria No. 8/2019 of 
the CC in Case No. 4/2019).
Beyond any reasonable doubt in this case is the existence of a heightened public interest in the 
information contained in the report. Regulation 2016/679 gives enhanced protection to individuals in 
relation to the processing of personal data, but also strikes a balance with other fundamental rights, in 
particular freedom of expression and information, as those rights are provided for in
KLD DECISIONS
CPC November - December 2022 46
in the CPPCC and HOPES. For the reasons set out above, given the particular factual situation and the 
person's status as a public figure, the Committee finds that the dissemination of information about the 
person's health status regarding the Covid-19 vaccination is in the public interest and the public's right to 
be informed.
The publication in this case of such information is part and parcel of the task of the media in a 
democratic society, insofar as the information presented is true and provoked, as evidenced by the report, 
by the false information the person presents. The complainant's actions and the calls he made against 
vaccination and the statements made in the report in question, and not only there, that he would never have 
this 'liquid', do not correspond to the complainant's actual actions and are liable to mislead the public, 
given his status as a public figure and the impact he has on some of the citizens of the Republic of Bulgaria.
In this regard, the Commission considers that the processing is lawful and in accordance w i t h 
Art. 1 of the PDPA and there is no violation as alleged by the complainant, given that the consent of the 
person is not an element of the lawfulness of the processing of personal data for journalistic purposes, but 
the processing is carried out for the exercise of freedom of expression and the right to information in a 
democratic society.
regarding Dr. M.M.:
The above grounds for lawfulness of the processing of personal data by the media are irrelevant to 
the processing of personal data by Dr. M.M. The exemptions provided for the processing of personal data 
for journalistic purposes are inapplicable to Dr M.M. in her capacity as data controller.
It is undisputed from the evidence on file that on 06.01.2022 and 07.01.2022, Dr M.M.'s personal 
electronic signature was used to access details of Mr N.D.'s vaccination status, namely date of registration of 
immunisation, national reference number of immunisation, sequence of dose, date of next vaccination and 
availability of certificate. The data access channel was immuno.his.bg, the login to the system was done 
via a qualified electronic signature, after checking whether the doctor concerned had an active registration 
with the Bulgarian Medical Association. It is undisputed that the access was made from the IP address 
*******, an external IP address of the medical institution of the Medical Centre where Dr M.M. worked 
at the date of access.
The evidence is undoubtedly a special category relating to a person's state of health, for the reasons 
set out above. With regard to the latter, the GDPR introduces a prohibition on their processing (Article 9(1) 
GDPR), while allowing for explicit and limitative exceptions (Article 9(2) GDPR). In the present case, there 
is no evidence in the file of the existence of any of the exceptions introduced by the legislator in Article 
9(2)(a) to (j) in respect of Dr M.M. The data were accessed without the person's knowledge or consent, as 
the defendant was not Mr N.D.'s personal and/or attending physician, was not a patient of the medical 
establishment, and had not performed any medical examinations or manipulations at the medical 
establishment.
In the course of the proceedings, Dr. M.M.'s legal representative alleges that a procedure was 
established that required the physician to physically provide this electronic signature, including 
allegations that the electronic signature was issued for official purposes. However, the facts alleged by 
counsel have not been established in the course of these proceedings; to the contrary, the evidence 
gathered by Borika plc and the internal rules and procedures, including the manager's order, establish first 
that the signature was issued to Dr M.M. in her personal capacity, notwithstanding that it was obtained by 
an attorney with Dr M.M.'s authorisation, and the procedures that have been set up at the hospital do not 
require the provision and storage of the electronic signature by the hospital employee, namely the head 
nurse, but only support the work of the doctors, and at their request.
KLD DECISIONS
CPC November - December 2022 47
Evidence in the record establishes that Dr. M.M.'s gross negligence with respect to the storage 
and use of her personal electronic signature resulted in unauthorized access to sensitive personal data 
about the complainant related to her vaccination status. Responsibility for the latter lies with the data 
controller, Dr M.M., in so far as the signature used for access is personal and the responsibility for its use 
and storage is also personal. However, in the present case, Dr. M.M. did not take appropriate measures to 
ensure and was able to demonstrate that the personal data of the complainant were processed/accessed in 
accordance with the GDPR. The allegations that the provision of the signature for use by an employee of 
the administration of the medical establishment was in fulfilment of a duty imposed on Dr M.M. by the 
medical establishment at which she worked cannot be credited as relevant and true. In the first place, 
there is no evidence to that effect; her allegations are disputed by the medical establishment, which 
categorically indicates that the company provides each physician with assistance in the administration of 
services, but at the physician's request and initiative, and not under obligation. Separately, even if the 
converse were true, insofar as the signature is personal, it is the data controller, in this case Dr. M.M., 
w h o s h o u l d determine the purposes, means and manner in which personal data will be 
processed/accessed through her electronic signature. Moreover, a specific category of personal data is 
accessed through the signature - health-related, and therefore the controls and measures put in place by 
the controller should be heightened. These are not present in this case at all, therefore the error 
committed by Dr. M.M. should be qualified as such under Article 32 par. 1 and 2 of the GDPR, as there is 
no undisputed evidence to hold her liable for the access actually made. It is a fact that, by means of the 
electronic signature, not on one occasion but on two consecutive dates, the applicant's sensitive personal 
data were unlawfully and without justification accessed in an electronic environment from the IP address 
of the medical institution where Dr M.M. M.M., who claims that she only became aware of the 
infringement after she was notified by the CPT of the present proceedings, i.e. months after the 
infringement took place.
The allegations that another person misused and improperly accessed the personal data using Dr. 
M.M.'s electronic signature, even if well-founded, although there is no such evidence in the file, cannot 
sanitise the infringement, in so far as it is the responsibility of the controller (Article 32(1) and (2) 
GDPR) to apply measures appropriate to prevent the unlawful processing of personal data, having regard 
to the scope, context and purposes of the processing, as well as the risks of varying likelihood and 
severity to the rights of natural persons. There are no measures at all in this case, a circumstance which is 
confirmed by the legal representative of Dr M.M., who states that her confidante does not use her 
signature, or regulate access to immuno.his.bg, a huge database of sensitive personal data, access to which 
is regulated and restricted, provided by means of a qualified electronic signature, after verification of 
whether the doctor concerned holds an active registration with the Bulgarian Medical Association. It is 
undisputed that Dr. M.M. did not organize the storage of the signature, which is the input for the database 
containing information on the health conditions of the persons, respectively did not create, nor did she 
apply appropriate technical and organizational measures, did not make an assessment, did not evaluate 
the risks associated with the use of the signature and access to this special category of personal data.
Taking into account the established violation, the fact that it concerns the processing of a special 
category of data and the fact that the act is not a one-off and is completed, the Commission considers 
appropriate, effective and dissuasive the exercise of corrective power under Art. 1 and 2 of the GDPR. 
The corrective measures under Article 58(1)(a), (c), (d), (e), (f), (g), (h) and (j) of the GDPR are inapplicable 
because of the nature of the infringement, those under Article 58(2)(b) are disproportionate and those 
under (d) are inappropriate given the actions taken by Dr M.M. to control her electronic signature after the 
infringement was established.
KLD DECISIONS
CPC November - December 2022 48
In determining the amount of the fine, the circumstances that the violation was the first found by 
the CPMP with respect to this administrator, as well as the workload and commitment of Dr. M.M. and 
of physicians in general in the pandemic, should be qualified as mitigating factors. As aggravating factors, 
the Commission considers that the data accessed are special category and that this is a repeated 
infringement committed in conditions of negligence on the part of the controller.
with regard to the DCC
The evidence in the record, the allegations of the defendants, including those of SCC, also 
evidence a violation by the facility of Article 32 of the GDPR regarding the facility's practices for 
allowing the use of electronic signatures of physicians for the processing of sensitive personal health�related data, including access to such data. It is undisputed that the medical establishment, as a separate 
controller of personal data, had not, as of the date of the breach, January 2022, established appropriate 
technical and organizational measures for the processing of sensitive personal data by the administration 
of the medical establishment, or that those established were not able to ensure and demonstrate that the 
processing was carried out in accordance with the GDPR, moreover, that there was a lack of training and 
supervision regarding the procedure, albeit not formally prescribed, which, apparently from the evidence, 
has established itself as an unregulated and unregulated pra It is a fact that the infrastructure/IP address 
of the DCC was used for the unauthorized access, which did not establish a proper control mechanism. It 
is a fact that after initiation of the present proceedings, the company has "taken steps to correct the way of 
working in the company" and has put in place a training and briefing programme for all the employees of 
the company on the application of the GDPR and the rules newly introduced by the hospital, part of the 
changes relate to the use of electronic signatures, namely, "All personal electronic signatures are to be 
stored only by their owners, and the responsibility for storage is entirely theirs. The submission of monthly 
activity reports with an electronic signature shall be carried out as follows: the person who owns the 
signature shall personally provide it to an administrative officer, personally enter the security password 
(pin code) and in his presence the report shall be submitted to the NHIF by an administrative officer. After 
submitting the report, the owner of the signature picks it up. In this way the electronic signature is under 
constant control and monitoring of the owner. Assisting with the filing of the report by an administrative 
officer in the presence of the owner of the electronic signature is optional and to facilitate the work of 
physicians. At the discretion of the doctor, he may submit the monthly report independently." The fact is 
that the additional measures introduced cannot sanitise the inaction on the part of the health 
establishment, which by its passive behaviour contributed to the infringement committed, but are 
grounds for imposing a remedy under Article 58,
§ 2, point "b" of the GDPR - a formal warning to the company in view of the fact that, although at a later 
stage, the measures were reviewed and updated in accordance with its obligation under Art. 1 of the GDPR. 
The imposition of a sanction on the administrator of the DCC is disproportionate in so far as the 
administrator is not directly involved in the infringement committed, but by its passive behaviour has 
created further preconditions for its commission.
Guided by the above and pursuant to Art. 38, para. 3 of the Personal Data Protection Act, the 
Commission for Personal Data Protection,
DECIDE:
1. Declares complaint pPN-01-33/17.01.2022 unfounded with respect to M. EAD.
2. Declares the complaint well founded in respect of Dr M.M.
3. Pursuant to Article 83(4)(a) in conjunction with Article 58(2)(i)
KLD DECISIONS
CPC November - December 2022 49
of Regulation (EU) 2016/679 imposes on Dr. M.M. with ID******, as a personal data controller, a 
fine of BGN 500 (five hundred leva) for violation of Article 32, § 1 and 2 of the Regulation.
4. Declares that the complaint is well-founded with respect to DCC.
5. On the basis of Article 58, § 2, letter "b" of the GDPR, issues an official warning to the 
SCC with the UIC *********, as a personal data controller, for violation of Article 32, § 1 and 2 of 
the GDPR.
The decision is subject to appeal within 14 days of its delivery through the Commission for 
Personal Data Protection before the Administrative Court of Sofia - city.
After the judgment has entered into force, the amount of the penalty imposed shall be paid by bank 
transfer:
BNB Bank - Central Bank, IBAN: BG18BNBG96613000158601, BIC BNBGBGSD
Commission for Personal Data Protection, BULSTAT 130961721.
PRESENTER: MEMBERS:
Ventsislav Karadzhov /p/ Tsanko Tsolov /p/ 
MariaMateva /p