Banner1.jpg

ВАС - BAC (Bulgaria) - 2862/2024

From GDPRhub
ВАС - BAC (Bulgaria) - 2862/2024
Courts logo1.png
Court: ВАС (Bulgaria)
Jurisdiction: Bulgaria
Relevant Law: Article 6(1)(b) GDPR
Article 6(1)(c) GDPR
Article 6(1)(e) GDPR
Article 106(1)(3) Civil Registration Act
Article 125(3) Energy Act
Decided: 22.11.2024
Published: 05.12.2024
Parties: Bulgarian Data Protection Authority
Toplofikacia Sofia EAD
Supreme Administrative Court of Bulgaria
National Case Number/Name: BAC (Bulgaria) - 2862/2024
European Case Law Identifier:
Appeal from: Bulgarian Data Protection Authority
ПНМД-01-53/2022
Appeal to: Appealed - Confirmed
Administrative Court of Sofia
7310/2022
Original Language(s): Bulgarian
Original Source: Bulgarian Data Protection Authority (in Bulgarian)
Initial Contributor: Kaloyan Petrov

The Supreme Administrative Court rejected an energy provider’s request to access a state-owned population register since the energy provider could not provide a valid legal basis.

English Summary

Facts

Toplofikacia Sofia EAD, the controller, is a Bulgarian company that provides heating services to its customers, both individuals and companies, in the Sofia metropolitan area. The controller submitted a request to the Ministry of Regional Development for access to several registers of personal data of the Bulgarian population. The reasoning for the request was that the access will facilitate the execution of the contracts between the controller and its customers.

The Ministry of Regional Development refused to provide access to the registers that keep significant amount of personal data, including inheritance information, and advised the controller for the optional procedure under Article 125(3) of local Energy Act to seek permission from the Bulgarian Data Protection Authority.

In May 2022 the controller submitted a request to the DPA asking for revocation of the Ministry's decision. In its request the company referred to the legal bases of (i) the performance of contract (Articles 6(1)(b) GDPR), (ii) the compliance with a legal obligation (Article 6(1)(c) GDPR), and (iii) a task carried out in the public interest (Article 6(1)(e) GDPR) for the requested access to the registers.

The DPA carried out a corresponding analysis for each of these legal bases and decided that none of them is applicable for the controller. The DPA refused to grant permanent access to the registers and instructed the company to provide a solid justification for any future request to the Ministry.

In July 2022, the controller appealed the decision of the DPA before the Administrative Court of Sofia.

The Administrative Court of Sofia upheld the decision confirming the analysis of the DPA and on top of it pointing out that the registers provide information for the entire population of Bulgaria, while the company operates only in the Sofia region.

Subsequently, the controller appealed the decision to the Supreme Administrative Court.

Holding

The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. The Court repeated the justification of the DPA and the lower court about why the controller cannot rely on the specified legal basis, respectively:

  • Article 6(1)(b) GDPR is not applicable because Article 125(3) of the local Energy Act specifies the data needed for conclusion of contract;
  • Article 6(1)(c) GDPR is not available as a legal basis because the processing is not necessary to comply with a legal obligation under a law;
  • Article 6(1)(d) GDPR is not applicable because the collection of receivables of a company is not a public interest.

Comment

The company's main objective was to obtain information from the registers about the heirs of its deceased customers who had outstanding debts. It is much easier for a Bulgarian creditor to start a debt collection procedure if he has this information at hand, rather than having to go to court to find out who the heirs are and where they live.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

Republic of Bulgaria

Commission for Personal Data Protection