BAC (Bulgaria) - № 6515
| BAC (Bulgaria) - ВАС - № 6515 | |
|---|---|
 | |
| Court: | BAC (Bulgaria) (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 6 GDPR Article 6(1)(b) GDPR Article 6(1)(c) GDPR Article 79(1) GDPR Article 82(1) GDPR |
| Decided: | 29.06.2022 |
| Published: | |
| Parties: | |
| National Case Number/Name: | ВАС - № 6515 |
| European Case Law Identifier: | |
| Appeal from: | Administrative Court of Sofia-city 6611 |
| Appeal to: | Not appealed |
| Original Language(s): | Bulgarian |
| Original Source: | Върховния административен съд (in Bulgarian) (in Bulgarian) |
| Initial Contributor: | Marieta Gencheva |
Bulgarian Supreme Administrative Court confirmed, that the processing of data of the natural persons, included in notarial deed, by the heat company in front of the court in civil proceedings is without the existence of grounds of Article 6 GDPR.
English Summary
Facts
The data controller is "Toplofikacia Sofia" EAD - district heating company in Bulgaria. The data subjects are customers of the company.
In one court proceedings in front of District Court Sofia, "Toplofikacia Sofia" EAD has submitted to the court data on the property and financial situation of the data subjects, contained in the deed of mortgage on the dwelling.
The Administrative Court of Sofia-city found that the data on the property and financial situation of the data subjects contained in the deed for the establishment of a contractual mortgage on the housing, submitted by heat company before the Sofia District Court, in the case was made without the existence of the grounds under Article 6 GDPR, therefore the defendant committed an offence by unlawfully processing personal data through collection, storage and transmission/distribution, by ordering "Toplofikacia Sofia" EAD in the action with legal grounds under Article 79(1) GDPR and Article 82(1) GDPR to pay the data subjects, the sum of 127.82 Euro (250 BGN) each, representing compensation for non-material damages resulting from the unlawful processing of their personal data.
"Toplofikacia Sofia" EAD has appealed against the decision. In its appeal, it maintained, that the interpretation of the provisions of the Energy Act, governing the sale of heat for domestic purpose by the Administrative Court of Sofia-city is incorrect interpreted, as well as the nature of the legal relationship arising from the publicly known generla terms and conditions, therefore the processing of personal data is legitimate, carried out on the legal basis under Article 6 (1)(c) GDPR.
Holding
Bulgarian Supreme Administrative Court confirm the decision of the Administrative Court of Sofia-city.
First, the Court considered, that there is an unlawful processing of the data of the data subjects, which are contained in the deed of contractual mortgage on the dwelling, submitted by the data controller in the civil proceedings before the District Court Sofia, since the data controller is not a party of this legal relationship and also the mortgage of the property and these data are in no way related to the supply of heat. Therefore, the Court confirmed, that there is no ground for the processing of these data under Article 6 (1)(b) - the processing of the personal data of the person is necessary for the performance of a contract to which the data subject is a party.
Second, the legal basis under Article 6(1)(c) GDPR is not applicable, since the processing of the data contained in the deed of mortgage by providing them in a pending civil dispute is not necessary to comply with a legal obligation under the contract for the sale of heat concluded between the parties.
Third, the Court found out, that the data of data subjects have been unlawfully processed in violation of the norms of the Regulation, due to the lack of their knowledge and their consent for using of the deed of contractual mortgage in the civil proceedings in the case of the Sofia District Court.
The appeal does not contain any specific complaints concerning the compensation awarded for non-material damages caused by the unlawful processing of the data, both as regards the grounds and the amount thereof. Having examined the judgment, the Court finds that, in accordance with the evidence in the case and the logical links between them, the Administrative Court Sofia found that there was a direct causal link between the unlawful acts of the applicant and the unlawful result suffered by the applicants, the ordinary damage suffered by them in the form of embarrassment and anxiety as a result of the dissemination of data concerning their financial and financial situation and the possible misuse of that data.
Causing a perception of anxiety about the breach of the security of the protected good (personal data) is sufficient to engage the responsibility of the person who has the duty to ensure it and to prevent violations of the fundamental rights guaranteed by European law.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
The proceedings are in accordance with Art. 208 et seq. of the Administrative Procedure Code (APC). Formed on a cassation appeal of "Toplofikatsia Sofia" EAD, through a legal representative, against decision No. 6611 of 11.11.2021. , decreed under adm. case No. 10954/2020 of the Administrative Court - Sofia - city, in its part, by which it was accepted that the processing of the data on property and financial status contained in a notarial deed for the establishment of a contractual mortgage of G. Atanasova and S. Atanasov was carried out in the absence on the grounds under Article 6 of Regulation 2016/679, and "Toplofikatsia Sofia" EAD was convicted of the claim with legal grounds under Article 79, paragraph 1 and Article 82, paragraph 1 of Regulation (EU) 2016/679 on European Parliament and of the Council of 27.04.2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC(GDPR) to pay G. Atanasova and S. Atanasov the amount of BGN 250 for each of them, representing compensation for non-pecuniary damage caused by the unlawful processing of their personal data, together with the legal interest on this amount, counted from the entry into force of the court decision until its final payment. The cassator maintains in the cassation appeal that the decision in the appealed part is incorrect - due to a violation of the substantive law, substantial violations of the procedural rules and unreasonableness, requests its cancellation, rejection of the claims for compensation and interest, award of legal fees, alternatively makes an objection of excessiveness of the attorney's fees claimed. The defendant in the cassation appeal - G. Atanasova does not express an opinion on the cassation appeal. The defendant - S. Atanasov, in a court session, expressed an opinion that the cassation appeal was groundless. The representative of the Supreme Administrative Prosecutor's Office gives a reasoned conclusion that the cassation appeal is groundless. The Supreme Administrative Court, fifth department, having assessed the admissibility of the cassation appeal and the annulment cassation grounds cited in it, according to Art. 209 of the APC, accepts the cassation appeal as procedurally admissible, as filed in time and by the proper party, but examined in substance as unfounded. With the disputed decision No. 6611 of 11.11.2021, issued under the adm. case No. 10954/2020 of the Administrative Court - Sofia - city, it was accepted that the processing of the data on property and financial status, which are contained in a notarial deed for the establishment of a contractual mortgage of G. Atanasova and S. Atanasov, was carried out in the absence of the grounds under Art. 6 of Regulation 2016/679, and "Toplofikatsia Sofia" EAD was convicted in the claim with legal grounds under Art. 79, par. 1 and Art. 82, par. 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/ EC (GDPR) to pay G. Atanasova and S. Atanasov the sum of 250 BGN for each one, representing compensation for non-pecuniary damage caused by the unlawful processing of their personal data, together with the legal interest on this amount, calculated from the entry into force of the court decision until its final payment. The Administrative Court accepted as established that the data on the property and financial status of the plaintiffs, which are contained in a notarial deed for the establishment of a contractual mortgage on the home, entered in the Registration Office under No. 78, Item XVII, Case No. 23687/2003. , presented by "Toplofikatsia Sofia" EAD before the Sofia District Court in case No. 56991/2019. was carried out without the existence of grounds under Article 6 of Regulation (EU) 2016/679 of the EP and of the Council, due to which the defendant committed a violation by unlawfully processing personal data through collection, storage and transmission/distribution. In view of this decisive legal conclusion, according to the ASSG, all the elements of the factual composition of art. 39, para. 2 of the GDPR for engaging the responsibility of the administrator of personal data and given the indisputably established unlawful processing of the plaintiffs' data, the court considered that it is normal for them to experience inconvenience, worry and uncertainty. Given the lack of committed evidence for the alleged non-pecuniary damages, the court has accepted that no greater damages than the natural anxiety that any person would feel in a similar situation can be proven. He considered that there is a direct cause and effect relationship between the illegal actions of the defendant and between the illegal result, as well as between it and the suffered non-pecuniary damages and according to Art. 52 of the ZZD, taking into account that the damages are expressed only in the usual mental distress awarded compensation in the amount of BGN 250. for each of the plaintiffs. The court decision rendered in this way is correct. The administrative court was referred to an admissible complaint and a claim for compensation, which contained allegations of unlawful processing of personal data with resulting damages, and the Commission was not referred to this issue for the protection of personal data. According to Art. 39, para. 1 of the Labor Code, in case of violation of his rights under this law, any natural person may appeal the actions and acts of the administrator in court before the relevant administrative court or before the Supreme Administrative Court under the general rules of jurisdiction. In this proceeding, the natural person can request compensation for the damages suffered by him as a result of unlawful processing of personal data by the administrator. In the absence of other rules, the claim should be examined by the administrative court with the corresponding application of the order of Art. 204 et seq. of the APC in connection with Art. 144 of the APC referring to the CPC. A condition for eligibility is only the absence of pending proceedings before the Personal Data Protection Commission (PCPD) for the same violation, its appealed decision regarding the same violation, or a court decision that has entered into force. In the present case, a certificate from the CPLD was presented to the ACSG, from which it was established that there were no proceedings before it on the same dispute, which also follows the absence of court proceedings on appeal of a decision of the CPLD. Based on the stated considerations, the current court panel finds that the ASSG correctly accepted the complaint for consideration and joined it with a claim for compensation as a court with generic and local competence to consider this dispute. The appealed court decision was rendered in a legal composition and after referral with a regular complaint and a claim. When examining the dispute before the first instance, no procedural violations were committed and the factual situation was correctly established based on all the evidence collected in the case. In a correctly established factual situation, the deciding court has substantiated correct legal conclusions, which are fully shared by the present instance. Correctly, the court of first instance, upon an overall assessment of the evidence collected in the case, as well as the arguments and objections of the parties, came to the conclusion that there was consent of the plaintiffs for the processing of their personal data: names, social security number, address and subscriber number contained in the documents , which were provided personally by the claimants to the personal data controller, and that there was no such consent in relation to the title document and notarial deed of contractual mortgage, but in relation to the title document he assumed that such consent was given by confirmation - connection to the heat transmission network, which is permissible only after establishing property rights on the property. The unlawful processing of the data of the plaintiffs G. Atanasova and S. Atanasov, which are contained in a notarial deed for a contractual mortgage, presented by the defendant in the civil case proceedings before the SRC, has been undisputedly established, since the defendant is not a party to the legal relationship and the mortgage of the property and these data are in no way related to the supply of heat energy. That is why the ASAG correctly assumed that there is no basis for processing this data under Art. 6, §1, b "b" of the Regulation - that the processing of the person's personal data is necessary for the performance of a contract under which the subject of data to be a party. The processing is unlawful. The assessor is an administrator of personal data and since it has been indisputably proven by the factual side an action on processing personal data in the sense of the legal definition of paragraph 1, item 1 of the Additional provisions of the LLPD in connection with art. 4, item 1 of the Regulation, which was found to have been carried out without the consent of the natural persons and in the absence of the grounds under Art. 6, § 1 of Regulation (EU) 2016/679, the same was correctly accepted as a violation. The objection in the cassation appeal for a violation of the substantive law admitted by the court of first instance is unfounded. Contrary to what the company claims, the personal data of G. Atanasova and S. Atanasov were illegally processed in violation of the norms of the Regulation, due to the lack of knowledge and consent on their part to provide a notarial deed for a contractual mortgage in the proceedings under city case No. 56991/2019. according to the inventory of the SRS, which was proven beyond dispute in the case. The complaint in the cassation appeal about the court's misinterpretation of the provisions of the Energy Act governing the sale of heat energy for domestic needs, as well as the nature of the legal relationship arising from public certain general conditions proposed by the heat transfer company and approved by KEVR, which is why the processing of personal data is legitimate, carried out on a legal basis, according to Article 6, paragraph 1, b "c" of Regulation (EU) 2016/679. These allegations were brought before the court of first instance, which reasoned and consistently discussed them and came to a lawful conclusion that the legal basis asserted by the defendant under Art. 6, para. 1, b. "c" of the Regulation is not available, since the processing of the data contained in a notarial deed for an established contractual mortgage, by providing them in a pending civil legal dispute, is not necessary to comply with a legal obligation of the defendant under the sales contract concluded between the parties of thermal energy in accordance with Article 150 of the Law on Energy. Pursuant to Art. 153 of the Law on Energy and for certification of the real property right of the claimants, it is sufficient to provide the document of ownership - contract for purchase - sale of real estate dated 14.01.2020. and the data contained therein certifying this right. That is why the court correctly accepted that there is no basis under Article 6, paragraph 1, b."c" of the Regulation that the processing of the data in the notarial deed is necessary to comply with a legal obligation of the data administrator under agreements between the parties contract for the supply of thermal energy. The cassation appeal lacks specific complaints regarding the awarded compensation for non-property damages caused by the unlawful processing of the plaintiffs' personal data, both on the basis and on their amount. Upon the verification of the court decision, the current instance accepts that in accordance with the evidence collected in the case and the logical connections between them, the existence of a direct causal link between the unlawful actions of the plaintiff and the unlawful result for the plaintiffs, experienced by them habitual damages expressed in concern and anxiety as a result of the information about their property and financial situation that has been disseminated and the possible misuse of this information. Reasonably and in accordance with the enduring jurisprudence in the field of tort, the ACSG holds that the experience of worry, anxiety and restlessness constitute non-pecuniary damages subject to compensation. The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (Charter/CFR) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of their personal data. The principles and rules regarding the protection of natural persons in relation to the processing of their personal data should, regardless of their citizenship or place of residence, be consistent with their fundamental rights and freedoms, and more specifically, with the right to the protection of their personal data. In this sense, any violation of a fundamental right must be considered particularly significant. Causing a feeling of alarm from the breached security of the protected asset (personal data) is sufficient to engage the responsibility of the person who has the duty to guarantee it and not allow violations of rights based on European law guaranteed. The present judicial panel finds that with the correct application of Art. 52 of the ZZD, the amount of compensation due has been determined, which is consistent with the circumstances of the anxiety and worry experienced by the plaintiffs, which is not above the usual amount and consistent with the standard of living in the country. the stated considerations and on the basis of Art. 221, para. 2, sentence two of the APC, the present judicial panel accepts that the appealed decision of the ASSG is valid, admissible and correct, as the grounds cited in the cassation appeal are not present, therefore it should be left in force. The decision states case number 10984/2020. of the ASSG, which is different from the actual number under which the case No. 10954/2020 was initiated. of the ASSG, but the current court finds that it is a technical error in writing the number, which does not constitute a cassation ground for annulment of the decision on this basis. The defendants in cassation have not claimed costs, which is why they should not be awarded, and in view of the outcome of the dispute, in favor of the cassator, they are not owed. For these reasons, the Supreme Administrative Court, fifth department, DECIDES: UPHOLD the decision No. 6611 of 11.11.2021 by adm. case No. 10954/2020 of the Administrative Court - Sofia - city. The DECISION is final and not subject to appeal.
