ACS - 38878
From GDPRhub
| ACS - 38878 | |
|---|---|
 | |
| Court: | ACS (Bulgaria) |
| Jurisdiction: | Bulgaria |
| Relevant Law: | Article 12 GDPR Article 15 GDPR |
| Decided: | 21.11.2025 |
| Published: | |
| Parties: | Izi Asset Management |
| National Case Number/Name: | 38878 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Bulgarian |
| Original Source: | APIS (in Bulgarian) |
| Initial Contributor: | dt |
A court revoked a credit company’s refusal to provide a copy of a credit agreement to a consumer’s representative. The court found that the representative submitted a valid request for information based on an explicit power of attorney.
English Summary
Facts
A data subject initiated proceedings in front of the Administrative Court of Sofia - City against Izi Asset Management (the controller) due to the refusal of the controller to provide them with a copy of a consumer credit agreement in accordance with Article 15 GDPR. The data subject’s representative, an attorney, contacted the controller via email to request the copies.
The controller based its refusal on an alleged lack of explicit power of attorney on the part of the data subject’s representative.
Holding
The court found that the controller’s refusal was unlawful. It noted that the request was valid under Article 15 GDPR, since the representative already indicated the power of attorney with an express right to file a complaint on the data subject’s behalf. The court noted that there were no grounds to require the submission of additional evidence by the representative of the data subject. Furthermore, it emphasised the obligations of the controller to provide information to the data subject under Article 12 GDPR.
Therefore, the court revoked the controller’s decision to terminate the proceedings with the data subject regarding the provisions of the requested copies, and referred the case back to the controller for a decision on the merits of the request.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.
Decision No. 38878 of 21.11.2025 of the Administrative Procedure Code - Sofia under administrative order No. 8650/2025 Art. 197 et seq. of the Administrative Procedure Code /APC/ Art. 37b LPPD Art. 37c, para. 1, item 3 LPPD Art. 56, para. 4 APC Regulation (EU) 2016/679 Art. 30 APC Art. 56, para. 2 APC Art. 30, para. 2 APC Art. 15 22 of Regulation (EU) 2016/679 Law on Electronic Documents and Electronic Certification Services Law on Electronic Governance Law on Electronic Identification Art. 37c, para. 1 LPPD Art. 12 of Regulation (EU) 2016/679 Directive 95/46/EC p. 21 of the Decision of 4 May 2023 in Case C-487/21 p. 45 of the Decision of 4 May 2023 in Case C-487/21 Article 15, paragraph 3, first sentence of the GDPR Art. 37c, para. 2 of the PDPA Art. 200, para. 1 Art. 143, para. 1 of the APC Art. 200, para. 2 of the APC Art. 137 APC Ruling No. 38878 Sofia, 21.11.2025 ADMINISTRATIVE COURT - SOFIA-CITY, Second Department 40 Chamber, in a closed session on 21.11.2025 in the following composition: JUDGE: Dilyana Nikolova having examined case number 8650 of the inventory for 2025 reported by the judge, and in order to rule, took into account the following: The proceedings are in accordance with Art. 197 et seq. of the Administrative Procedure Code /APC/. It was instituted upon a complaint by M. B. R., filed through attorney N. R. – BAK, against the refusal of "EASY ASSET MANAGEMENT" AD to provide a copy of a consumer credit agreement containing personal data of the complainant with a request for its cancellation as unlawful. With the administrative file, the respondent submitted an Act for termination of the administrative proceedings dated 14.08.2025 /issued after the filing of the appeal/, due to failure to eliminate the irregularities of the application. In this regard, with Order No. 32102/01.10.2025, the court instructed the appellant to explicitly indicate in a written application whether she maintains her appeal against the refusal of the personal data controller on the application submitted by her or whether the appeal should be considered directed against the act for termination of the proceedings initiated on the application. With an application filed in the case on 20.10.2025, the appellant, through attorney. R., states that it fully supports the filed complaint, as it is formulated and that the subsequent act to terminate the proceedings is without legal significance, since the request to the personal data controller was made in electronic form, which is an option expressly provided for in Regulation (EU) 2016/679 and the request for additional documents in plain writing or with notarized signatures, as well as their physical transfer for reference purposes is inadmissible, since the user has chosen the electronic form of correspondence with the controller. Therefore, the disputant believes that the defendant in the complaint was addressed with a regular request with a legal basis of Art. 37b of the PDPA. The controller should, on the basis of Art. 12, § 12 of the regulation, assist in exercising the rights of the data subject even if the application does not fully meet the requirements specified in Art. 37c, para. 1, item 3 of the PDPA, notifying the person within one month of the reasons why he does not take action and of the possibility of seeking protection of his rights from the supervisory authority and the court. The content of the clarification request thus stated indicates disagreement with the reasons of the respondent for termination of the proceedings or in essence, although the complainant states that she maintains the complaint in its original form, of contesting the act for termination of the proceedings initiated upon her application. In view of the above, the court finds that it has been referred to an appeal against the act for termination of the proceedings initiated upon the application submitted by the complainant. According to the provision of Art. 56, para. 4 of the APC, the act for termination of the proceedings may be appealed under the procedure of Chapter Ten, Section IV - Art. 197 et seq. According to Art. 197 of the APC, the appeal is filed within 14 days of the notification. In the present case, the act, subject to challenge, was issued on 14.08.2025, and the complaint, on which the present proceedings were initiated on 11.08.2025, was filed by a person who is the addressee of the act and whose legal sphere it adversely affects, and is accordingly admissible. Examined on the merits, the complaint is well-founded. The parties do not dispute and the evidence in the case establishes that on 29.06.2025, attorney R. as the applicant's attorney, submitted by e-mail to the respondent company at [e-mail], a request with legal grounds under Art. 37b of the Personal Data Protection Act. With the request, he requested the company, in its capacity as a personal data administrator, to provide him with a copy of the Credit Agreement No. 5101008 concluded between him and M. B. R., under which the company provided her with a loan, together with all documents accompanying the agreement - a repayment plan and all annexes to the agreement, including the surety agreements. Attorney R. explicitly indicated that the request was made with a view to verifying the legality of the processing of personal data and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council. As attachments to the request, the attorney indicated a power of attorney, as evident from the e-mail - p. 9 /back/, the power of attorney was presented as an attached file. The power of attorney itself is presented on p. 11 of the case and it is evident from it that the complainant authorized attorney R. to represent her before all judicial instances in the country with the rights to organize defense in initiated proceedings, to determine the subject of the dispute, to make statements and to dispose of the subject of the case without limitation, incl. to withdraw claims, as well as to conclude settlements. The power of attorney also includes an explicit clause that the attorney has the right to represent her and sign before "EASY ASSET MANAGEMENT" AD by requesting and receiving a copy of the loan agreement No. 5101008 concluded between her and the company, together with the documents accompanying the agreement, as well as having the explicit rights to file a complaint against "EASY ASSET MANAGEMENT" AD with the Personal Data Protection Commission or to refer the matter to the relevant court in the event of a possible refusal by "EASY ASSET MANAGEMENT" AD to provide the concluded consumer loan agreement. In response to this request, on 01.07.2025 by the company to attorney. R. was sent a letter by e-mail stating that a loan agreement for 1,500 leva was concluded between him and the complainant on 25.04.2024, and as of that date /01.07.2025 / a principal amount of 1,000 leva had not been repaid, in connection with which a proposal was made to conclude an agreement to settle their relationship. After receiving this response, attorney R. on the same date at 4:23 p.m. sent a second letter /message/ stating that he wished to receive a response to the application submitted on 29.06.2025. By e-mail on 01.07.2025 at 4:35 p.m., the attorney was notified that the application had been forwarded to the competent officials, who would notify him of the decision. On 28.07.2025, a letter was sent to attorney R. by e-mail /l. 12/, informing him that the application was irregular and in order to be considered, it was necessary to present an explicit power of attorney to exercise the rights under Art. 15 - 22 of the Regulation, as well as to specify which of them is being exercised, taking into account that the request for copies of contracts and accompanying documents does not in essence constitute an exercise of rights under Art. 15 - 22 of the Regulation. The presentation of an explicit power of attorney and clarification was instructed to be carried out within 3 working days of the notification, and in the case of electronic submission, the documents were to be signed with a QES. It was indicated that the administrator would make a decision within one month after submission of the requested documents. The complaint, on which the present proceedings were initiated, was filed directly with the court on 11.08.2025. On 19.08.2025, the administrative file was submitted to the court, and in the accompanying letter, the defendant in the challenge stated an objection to the inadmissibility of the complaint, since there was no refusal of the applicant's application. He considered the same irregular and, in accordance with his rights under Art. 12, § 4 of the Regulation, gave instructions to eliminate irregularities to the applicant. He asks that in the event that the court considers the complaint admissible, to award the attorney's fee in a reduced amount, due to the lack of factual and legal complexity of the dispute. An Act for termination of the administrative proceedings on the basis of Art. 30 of the APC, due to the lack of a valid power of attorney presented in accordance with the given instructions, was submitted with the administrative file. The act was sent by e-mail to the complainant's attorney on the date of its issuance - 14.08.2025. According to the provision of Art. 56, para. 2 APC, the administrative body terminates the proceedings in the cases under Art. 30, para. 1 and 2. According to the specified provisions, when the written request is not signed and in case of doubt as to whether it comes from the citizen or organization specified therein, the administrative body requires its confirmation with a handwritten or electronic signature within three days of the notification thereof. If confirmation is not made within the time limit, the proceedings are terminated /para. 1/, and if the request does not meet the other requirements of the law, the applicant is notified to eliminate the deficiencies within three days of the notification thereof with an indication that failure to eliminate them will cause the termination of the proceedings /para. 2/. Although the defendant did not indicate which specific ground he is referring to, it is evident from the content of the contested act that the applicable ground is that under Art. 30, para. 2 APC – failure to comply with given instructions to eliminate irregularities in the notification application. To assess the legality of the act, the court should assess whether the given instruction is in accordance with the legal norm. According to the provision of Art. 37b of the PDPA, the data subject exercises the rights under Art. 15 - 22 of Regulation (EU) 2016/679 by means of a written application to the personal data controller or in another manner determined by the controller. An application may also be submitted electronically under the terms of the Electronic Document and Electronic Certification Services Act, the Electronic Governance Act and the Electronic Identification Act. An application may also be submitted through actions in the user interface of the information system that processes the data, after the person has been identified with the relevant means of identification for the information system. The application under Art. 37b contains 1. name, address, unique civil number or personal number of a foreigner or other similar identifier, or other identification data of the natural person, determined by the administrator, in connection with the activity performed by him; 2. description of the request; 3. preferred form for receiving information when exercising the rights under Art. 15 - 22 of Regulation (EU) 2016/679; 4. signature, date of submission of the application and correspondence address - Art. 37c, para. 1 PDPA. According to para. 2 of the Act, when submitting an application by an authorized person, the power of attorney is attached to the application. In accordance with the provision of Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), the controller shall take the necessary measures to provide any information referred to in Articles 13 and 14 and any communication referred to in Articles 15 to 22 and Article 34 relating to the processing to the data subject in a concise, transparent, intelligible and easily accessible form, in clear and plain language, in particular with regard to any information specifically addressed to children. The information shall be provided in writing or by any other means, including, where appropriate, by electronic means. If the data subject has requested this, the information may be given orally, provided that the identity of the data subject is proven by other means /§ 1/. The controller shall facilitate the exercise of the data subject's rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on a request from the data subject to exercise his rights under Articles 15 to 22, unless he demonstrates that he is unable to identify the data subject /§ 2/. According to Article 11(2) of the Regulation, where in the cases referred to in paragraph 1 of this Article the controller can demonstrate that he is unable to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply, unless the data subject, in order to exercise his rights under those Articles, provides additional information allowing his identification. According to Art. 12, § 6 of the Regulation, without prejudice to the provisions of Article 11, where the controller has reasonable doubts regarding the identity of the natural person submitting a request under Articles 15 - 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. In the specific case, in view of the evidence in the case, the data controller unlawfully requested from the applicant the presentation of an explicit power of attorney for the exercise of rights and the specification of the right that she wishes to exercise with the application submitted on 29.06.2025. From the application itself it is evident and infinitely clear which exact right the applicant is exercising - she requested the provision of a cash loan agreement, together with all accompanying documents, including surety agreements. Therefore, the requirement of additional specification was not necessary. Contrary to what the controller believes, providing copies of these documents constitutes providing access to personal data processed by it. According to paragraph 21 of the Judgment of 4 May 2023 in Case C-487/21 of the CJEU, "in so far as the GDPR does not define the concept of 'copy' as used, account must be taken of the ordinary meaning of that concept, which, as the Advocate General notes in paragraph 30 of his Opinion, designates an exact replica or transcription of an original, so that a mere general description of the data being processed or a reference to categories of personal data would not correspond to that definition. According to paragraph 23 of the same judgment, the use of the expression 'any information' in the definition of the concept of 'personal data' contained in that provision reflects the aim of the Union legislature to give a broad meaning to that concept, potentially encompassing any type of information, both objective and subjective, in the form of opinions or assessments, provided that it 'concerns' the person concerned. In paragraph 45 of the Judgment of 4 May 2023 in Case C-487/21 C-487/21 of the CJEU clarified that the first sentence of Article 15(3) of the GDPR must be interpreted as meaning that the right to obtain from the controller a copy of personal data which are being processed requires the data subject to be provided with an accurate and intelligible copy of all such data. This right implies the right to obtain a copy of extracts from documents and even of entire documents or of extracts from databases which contain, in particular, the said data, if the provision of such a copy is mandatory in order for the data subject to effectively exercise the rights granted to him by that regulation, while emphasising that in this respect the rights and freedoms of other persons must be taken into account. Next, the controller unlawfully required the presentation of an express power of attorney for the submission of an application for the exercise of the applicant's rights under Articles 15 to 22 of Regulation (EU) 2016/679 - an express clause to this effect is contains in the attached to the application of 29.06.2025 a power of attorney, which is sufficient and meets both the requirements under Art. 37c, para. 2 of the PDPA, and the requirements under Art. 11 and Art. 12 of the Regulation. The latter, as indicated, does not even set specific requirements in this regard, but regulates the actions of the administrator in cases where the data subject cannot be identified, and according to § 2 of Art. 11, the burden of proving this circumstance lies with the administrator. Based on the above considerations, the court finds that the data administrator was notified of a regular request and there were no grounds to require the applicant to submit additional evidence, respectively, there is no ground for terminating the administrative proceedings under Art. 56, para. 2 of the Code of Civil Procedure. The above justifies a conclusion that the contested act is unlawful, which should be annulled. Given this outcome of the case of The applicant shall be liable for the costs of the proceedings. Such costs have been proven to be in the amount of 10 leva for the paid state fee for the challenge. Attorney's fees should not be awarded, since there is no evidence of expenses incurred in the case - the legal aid contract cited in the annexes to the appeal is not attached to the case. We proceed from the above and on the basis of Art. 200, para. 1 and Art. 143, para. 1 APC, Administrative Court Sofiagrad, Second Department, 40th Chamber RULES: CANCELS upon the appeal of M. B. R. Act for termination of the proceedings dated 14.08.2025 of "EASY ASSET MANAGEMENT" AD, issued upon an application dated 29.06.2025 SENDS the file to the defendant for a ruling on the merits on the application filed by the applicant dated 29.06.2025 g., within one month from the entry into force of this ruling, taking into account the mandatory instructions on the interpretation and application of the law, given in its reasons. ORDERS "EASY ASSET MANAGEMENT" AD, UIC [UIC], to pay M. B. R., EGN [EGN], the amount of 10 /ten/ leva, representing costs of the proceedings. The ruling, on the basis of Art. 200, para. 2 APC, may be appealed with a private appeal within 7 days of its notification through the Administrative Court Sofia-city to the Supreme Administrative Court, by the parties participating in the administrative proceedings. The ruling shall be notified to the parties by sending a copy of it in accordance with Art. 137 APC. Judge:
