CPDP (Bulgaria) - PPN-01-88/2022
| CPDP - PPN-01-88/2022 | |
|---|---|
 | |
| Authority: | CPDP (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 12(4) GDPR Article 17 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | PPN-01-88/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Bulgarian |
| Original Source: | PDPC (in BG) |
| Initial Contributor: | Nikolija |
The Bulgarian DPA upheld that controllers must respond to a data subject's request for erasure, even if the request is not granted. The controller must state the grounds for refusal and available remedies.
English Summary
Facts
The data subject appeared in one video which can be found on the Youtube page of a media service provider (the controller). Subsequently, the data subject filed a complaint with the Bulgarian DPA claiming that the controller had failed to respond to the data subject’s request in relation to the right to erasure under Article 17 GDPR.
According to Article 12(4) GDPR, the data subject should give the data controller a response period of one month before lodging a complaint with the DPA. In this case, the data subject asked for their data to be erased from the Youtube page on 25 January 2022 and lodged a complaint with the DPA on 31 January 2022. However, even after the one month deadline had ended, the controller still had not responded to the data subject. Therefore, the complaints by the data subject were deemed admissible by the DPA.
According to the controller, the data subject gave their consent for participating in the filming and distribution of the audiovisual work project. Further, the data controller allegedly relied on journalistic purposes as a legal basis for processing the personal data of the data subject in this case.
Holding
In relation to consent as a legal basis for processing, the DPA held that the submitted declaration, without any date and addressee, did not constitute valid consent within the meaning of the GDPR. If signed bilaterally, the declaration can be characterised as a written agreement for participation in a TV programme. Therefore, in the absence of consent within the meaning of the GDPR, the data subject cannot rely on the right to be forgotten under Article 17 GDPR.
In relation to journalistic purposes used as a legal basis, the DPA concluded that despite processing information for journalistic purposes, the data processor should comply with the rules stemming from Articles 12-21 GDPR. Therefore, if the controller did not comply with the data subject’s request for erasure of personal data, the controller should have informed the data subject of that fact. The controller should state the reasons why and inform the data subject of the possibility of lodging a complaint with a supervisory authority or court. This should be done without undue delay, but no later than a month after the request was filed.
In this case, the data controller did not respond to the data subject’s request at all, violating Article 12(4) GDPR.
The DPA issued a formal warning to the controller for non-compliance with Article 12(4) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
