BAC (Bulgaria) - № 11179
From GDPRhub
| BAC - № 11179 | |
|---|---|
 | |
| Court: | BAC (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 5(1)(c) GDPR |
| Decided: | 20.08.2020 |
| Published: | |
| Parties: | Administrative body: Regional Inspectorate for Environment and Water - Montana Data subject: I.Nikolov |
| National Case Number/Name: | № 11179 |
| European Case Law Identifier: | |
| Appeal from: | Administrative court - Montana
|
| Appeal to: | |
| Original Language(s): | Bulgarian |
| Original Source: | Official website of SAC (in Bulgarian) |
| Initial Contributor: | Monika Dafinova |
The Supreme Administrative Court of Bulgaria (BAC) decided that the Regional Inspectorate for Environment and Water - Montana violated the principle of data minimisation as prescribed my Article 5, para. 1, b. 'c' of the GDPR, with regards to document content.
English Summary
Facts
Regarding administrative procedure for investment proposals, a data subject was provided with a protocol for granting access to information in accordance with RIEW Montana internal documentation. The protocol contained personal data the data subject did not consent to, and he saw that there are other protocols signed by other people. RIEW Montana presented internal documents in regards to processing of personal data.
Dispute
Was the principle of data minimisation violated by RIEW Montana?
Holding
The Supreme Administrative Court decided that there was a violation of the principle of data minimization.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
IN THE NAME OF THE PEOPLE The Supreme Administrative Court of the Republic of Bulgaria - Fifth Division, in a hearing on the twenty-ninth of June, two thousand and twenty, composed of: CHAIRMAN: GALINA KARAGIOZOVA MEMBERS: JULIA KOVACHEVA MARIA NIKOLOVA under Secretary Madeleine Dukova and with the participation of the prosecutor Veselin Naidenov heard the report by Judge JULIA KOVACHEVA according to adm. case № 2113/2020. The proceedings are under Art. 208 et seq. Of the Administrative Procedure Code (APC). It is initiated on a cassation appeal of the Regional Inspectorate for Environment and Water - Montana against decision № 592 of 25.11.2019 under Adm. case № 502/2019 of the Administrative Court - Montana. There are complaints about the irregularity of the judicial act due to its ruling in case of incorrect application of substantive law and lack of justification - cassation grounds for annulment under Art. 209, item 3 of the APC. The defendant in the cassation appeal - the Commission for Personal Data Protection, through its procedural representative, expresses an opinion that the appealed decision is correct and there are no cassation grounds for its annulment, as stated by the other party. The defendant - I. Nikolov, do not express an opinion regarding the cassation appeal. The prosecutor from the Supreme Administrative Prosecutor's Office gives a reasoned conclusion that the cassation appeal is unfounded. The Supreme Administrative Court, composed of the fifth division, finds that the cassation appeal is procedurally admissible as filed within the term prescribed by aw, and by a competent party. Considered on the merits, it considered unfounded for the following reasons: With the appealed decision, the Administrative Court - Montana rejected the appeal of the Regional Inspectorate for Environment and Water (RIEW) - Montana against decision № PPN-01-993 / 2018 / 11.09.2019 of the Commission for Personal Data Protection. With decision № PPN-01-993 / 2018 / 11.09.2019 of the Commission for Personal Data Protection which is contested before the Court of First Instance, a complaint with registration № PPN-01-993 from 06.12.2018, filed by I. Nikolov vs Regional Inspectorate of Environment and Water – Montana, was declared as well-founded, and an administrative fine in the amount of BGN 500 was imposed against the Regional Inspectorate of Environment and Water – Montana - pursuant to Art. 58, § 2, b. "and" in conjunction with Art. 83, § 5, b. "a" of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the movement of such data and repealing Directive 95/46 / EC EC (General Data Protection Regulation, GDPR) for violation of Art. 5, § 1, b. "c" of the GDPR - the principle of data minimisation. In a resolution of the dispute, the court correctly established the relevant factual circumstances of the case, and on the basis of an accurate analysis reached reasonable legal conclusions. The court correctly found that the Regional Inspectorate of Environment and Water - Montana is a controller of personal data and in this capacity has processed the personal data of I. Nikolov. The court found that on 05.12.2018 I. Nikolov visited RIEW - Montana to get acquainted with the documentation related to the investment proposal of "Bulgaria Recycle" Ltd. for the construction of an installation for processing and recycling of plastic in Lehchevo, Boychinovtsi municipality, Montana district. After getting acquainted with the materials in the file, I. Nikolov was provided with a protocol for granting access to information under Appendix № 2 to Art. 6 of the EIA Ordinance for a signature containing personal data, which he did not give a consent to be processed. In the same file I. Nikolov saw that there were other such protocols signed by other people. The Regional Inspectorate of Environment and Water – Montana presented internal documents in regards to processing of personal data. In view of these factual findings, the court decided correctly that the complainant RIEW - Montana, in the capacity of a controller of personal data, did not clarify in either the administrative or judicial proceedings the purpose for processing the personal data as required by protocol for granting access to information under Appendix № 2 to Art. 6 of the EIA Ordinance, including address for correspondence, having in mind that the fulfilment of the obligation under Art. 6, para. 9, item 1 of the Ordinance on the terms and conditions for carrying out environmental impact assessment may be certified without the processing of such data, as the processing of personal data is in violation of the principle of data minimisation - art. 5, § 1, b. "c" of the GDPR, respectively Art. 2, para. 2, item 3 (revoked) of LPPD ,and the processing is excessive. The court stated that the protocol, which is a template from, requires three names / nickname and registered office, address for correspondence and signature, and does not contain indications of mandatory or optional space, i.e. the content of the same does not give grounds to accept, since there is no explicitly stated such circumstance that the people who are granted access to the relevant information by filling in the relevant protocol have a choice and can leave blank space. In this case, it cannot be concluded from the evidence in the case that the data minimisation principle has been respected - Art. 5, § 1, b. "c" of the GDPR, the personal data are appropriate, related to and limited to what is necessary in relation to the purposes for which they are processed, due to which the court correctly concluded that there is a violation of the principle of data minimisation. In these circumstances, the court considered that the Commission for Personal Data Protection had lawfully imposed on the complainant an administrative fine in the amount of BGN 500, as provided in Art. 58, § 2, b. "and" in conjunction with Art. 83, § 5, b. "a" of the GDPR. The disputed subject matter of the case has been clarified from a factual and legal point of view. It is indisputable between the parties that RIEW Montana is a data controller. Therefore, RIEW Montana has a legal ground to process I. Nikolov's personal data, according to Art. 6, para. 1, p. "c" and "e" and para. 2 of the GDPR. This matter is not disputable in the case, the dispute is reduced to whether the processing is excessive, which violates Art. 5, § 1, b. "c" of the GDPR. According to Art. 5 of the GDPR, regulating the principles related to the processing of personal data, the latter shall be processed in accordance with the following principles specified in § 1 of the norm: lawfulness, fairness and in a transparency (b. "a"), purpose limitation (b. “b”), data minimisation (b. “c”), accuracy (b. “d”), storage limitation (b. “e”), integrity and confidentiality (b. “f”), as in § 2 the principle of accountability has been introduced, as the data controller is responsible and shall be able to prove the fulfilment of paragraph 1. The principle of data minimisation, Art. 5, § 1, b. "c" states that personal data should be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. In this case, contrary to the provisions cited by the Regional Inspectorate of Environment and Water - Montana, in its capacity as the data controller, does not establish, neither in the administrative nor in the court proceedings, for what purpose collects and processes personal data from the protocol for granting of access to information under Appendix № 2 to Art. 6 of the EIA Ordinance, including address for correspondence, having in mind that the fulfilment of the obligation under Art. 6, para. 9, item 1 of the Ordinance on the terms and conditions for carrying out environmental impact assessment, requiring provision of public access to the information under Appendix № 2, may be certified without the processing of these data, which leads to a conclusion for a violation in the processing of personal data of I. Nikolov. The court correctly pointed out that according to the evidence in the case, the personal data of the person - three names/nickname and registered office, address for correspondence and signature, were processed in violation of the principle of data minimisation - Art. 5, § 1, b. "c" of the GDPR, respectively Art. 2, para. 2, item 3 of LPPD (revoked), and the processing is excessive. In the case it was clearly established that the complainant before the Commission I. Nikolov had not filled in the space for address for correspondence due to personal reasons. However, the data controller was obliged to instruct the persons who fill in a protocol for granting access to information under Appendix № 2 to Art. 6 of the EIA Ordinance, by indicating mandatory, resp. optional spaces in order to assume that the persons who receive the requested public access to the relevant information by filling in the procedural protocol are given a choice and have the opportunity to leave blank spaces, as it is supported by the cassation complainant. In the context of the above, the court correctly accepted that the processing of data by the Regional Inspectorate of Environment and Water - Montana is admissible, according to Art. 6, § 1, b. "c" and b. "e" of the GDPR, but exceeds the volume necessary for the implementation of the purposes for which they are processed, which violates the principle related to the processing of personal data regulated in Art. 5, § 1, b. "c" from GDPR. In view of the above, there are no grounds for cassation under Art. 209, item 3 of the APC for annulment of the appealed decision, due to which the same should be left in force. In view of the outcome of the dispute and the claim for costs awarded by the procedural representative of the defendant in cassation, the cassation complainant Regional Inspectorate of Environment and Water - Montana should pay the Commission for Personal Data Protection, the amount of BGN 100, costs for legal consulting remuneration on the grounds of art. 78, para. 8 of the Civil Procedure Code, in view of the referring norm of Art. 144 of the APC. Led by the above, the Supreme Administrative Court, Fifth Division, HAS DECIDED AS FOLLOWS: REMAINS IN FORCE decision № 592 of 25.11.2019 under Adm. case № 502/2019 of the Administrative Court - Montana. ORDERS the Regional Inspectorate of Environment and Water - Montana to pay to the Commission for Personal Data Protection the amount of BGN 100, costs for the present court instance. The decision is not subject to appeal.
