ВАС - BAC (Bulgaria) - 2862/2024
ВАС - BAC (Bulgaria) - 2862/2024 | |
---|---|
Court: | ВАС (Bulgaria) |
Jurisdiction: | Bulgaria |
Relevant Law: | Article 6(1)(b) GDPR Article 6(1)(c) GDPR Article 6(1)(e) GDPR Article 106(1)(3) Civil Registration Act Article 125(3) Energy Act |
Decided: | 22.11.2024 |
Published: | 05.12.2024 |
Parties: | Bulgarian Data Protection Authority Toplofikacia Sofia EAD Supreme Administrative Court of Bulgaria |
National Case Number/Name: | BAC (Bulgaria) - 2862/2024 |
European Case Law Identifier: | |
Appeal from: | Bulgarian Data Protection Authority ПНМД-01-53/2022 |
Appeal to: | Appealed - Confirmed Administrative Court of Sofia 7310/2022 |
Original Language(s): | Bulgarian |
Original Source: | Bulgarian Data Protection Authority (in Bulgarian) |
Initial Contributor: | Kaloyan Petrov |
The Supreme Administrative Court rejected an energy provider’s request to access a state-owned population register since the energy provider could not provide a valid legal basis.
English Summary
Facts
Toplofikacia Sofia EAD, the controller, is a Bulgarian company that provides heating services to its customers, both individuals and companies, in the Sofia metropolitan area. The controller submitted a request to the Ministry of Regional Development for access to several registers of personal data of the Bulgarian population. The reasoning for the request was that the access will facilitate the execution of the contracts between the controller and its customers.
The Ministry of Regional Development refused to provide access to the registers that keep significant amount of personal data, including inheritance information, and advised the controller for the optional procedure under Article 125(3) of local Energy Act to seek permission from the Bulgarian Data Protection Authority.
In May 2022 the controller submitted a request to the DPA asking for revocation of the Ministry's decision. In its request the company referred to the legal bases of (i) the performance of contract (Articles 6(1)(b) GDPR), (ii) the compliance with a legal obligation (Article 6(1)(c) GDPR), and (iii) a task carried out in the public interest (Article 6(1)(e) GDPR) for the requested access to the registers.
The DPA carried out a corresponding analysis for each of these legal bases and decided that none of them is applicable for the controller. The DPA refused to grant permanent access to the registers and instructed the company to provide a solid justification for any future request to the Ministry.
In July 2022, the controller appealed the decision of the DPA before the Administrative Court of Sofia.
The Administrative Court of Sofia upheld the decision confirming the analysis of the DPA and on top of it pointing out that the registers provide information for the entire population of Bulgaria, while the company operates only in the Sofia region.
Subsequently, the controller appealed the decision to the Supreme Administrative Court.
Holding
The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. The Court repeated the justification of the DPA and the lower court about why the controller cannot rely on the specified legal basis, respectively:
- Article 6(1)(b) GDPR is not applicable because Article 125(3) of the local Energy Act specifies the data needed for conclusion of contract;
- Article 6(1)(c) GDPR is not available as a legal basis because the processing is not necessary to comply with a legal obligation under a law;
- Article 6(1)(d) GDPR is not applicable because the collection of receivables of a company is not a public interest.
Comment
The company's main objective was to obtain information from the registers about the heirs of its deceased customers who had outstanding debts. It is much easier for a Bulgarian creditor to start a debt collection procedure if he has this information at hand, rather than having to go to court to find out who the heirs are and where they live.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
Republic of Bulgaria Commission for Personal Data Protection