CPDP (Bulgaria) - PPN-01-88/2022
| CPDP - PPN-01-88/2022 | |
|---|---|
 | |
| Authority: | CPDP (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 12(4) GDPR Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | PPN-01-88/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Bulgarian |
| Original Source: | PDPC (in BG) |
| Initial Contributor: | Nikolija |
The Bulgarian Personal Data Protection Commission has upheld that data controllers must respond to a data subject's request for erasure, even if the request may not be granted. The controller must state the grounds for refusal and available remedies.
English Summary
Facts
The complainant has complained to the Personal Data Protection Commission (PDPC) that the data controller has failed to respond to the data subject’s request in relation to the right to erasure under article 17 GDPR.
The data subject in question has appeared in one video which can be found on the YOUTUBE page of TV X.
The data controller in question is Foundation X, which is the registered provider of a linear media service of TV X.
According to article 12(4) GDPR, the data subject should give the data controller a response period of one month before lodging a complaint with the PDPC. In this case, the data subject asked for their data to be erased from the youtube page on 25.01.2022 and lodged a complaint with the PDPC on 31.01.2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the PDPC.
According to the Administrator’s opinion, the complainant has given their consent for participating in the filming and distribution of the audiovisual work for Foundation X’ project. This statement was appealed and was later heard by the PDPC.
Further, the data controller relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case. The PDPC analyzed this argument.
Holding
In relation to consent, the submitted declaration without any date and addressee does not constitute consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterized as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under article 17 GDPR.
In relation to journalistic purposes used as a legal basis, the commission made the following assessment:
It concludes that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from articles 12-21 GDPR. Therefore, if the controller does not comply with the data subject’s request for erasure of personal data, the controller should inform the data subject that their request will not be complied with. The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority and judicial remedy. This should be done with undue delay, no later than a month.
In this case, the data controller did not respond to the data subject’s request at all, not even the one month period has passed, violating article 12(4) GDPR.
The PDPC issued a formal warning to Foundation X for non compliance with article 12(4) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
