View source for BAC (Bulgaria) - 7890/2026

{{COURTdecisionBOX

|Jurisdiction=Bulgaria
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=BAC
|Court_Original_Name=Върховен аднимистративен съд
|Court_English_Name=Supreme Administrative Court of Bulgaria‎
|Court_With_Country=BAC (Bulgaria)

|Case_Number_Name=7890/2026
|ECLI=


|Original_Source_Name_1=APIS
|Original_Source_Link_1=https://apis.bg/bg/
|Original_Source_Language_1=Bulgarian
|Original_Source_Language__Code_1=BG


|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Date_Started=
|Date_Decided=13.07.2026
|Date_Published=
|Year=2026



|GDPR_Article_1=Article 5(1)(c) GDPR
|GDPR_Article_Link_1=Article 5 GDPR#1c


|GDPR_Article_2=Article 6(1)(f) GDPR
|GDPR_Article_Link_2=Article 6 GDPR#1f



|GDPR_Article_3=
|GDPR_Article_Link_3=

|GDPR_Article_4=
|GDPR_Article_Link_4=




|EU_Law_Name_1=
|EU_Law_Link_1=

|EU_Law_Name_2=
|EU_Law_Link_2=




|National_Law_Name_1=
|National_Law_Link_1=

|National_Law_Name_2=
|National_Law_Link_2=




|Party_Name_1=
|Party_Link_1=

|Party_Name_2=
|Party_Link_2=


|Appeal_From_Body=Administrative Court of Stara Zagora
|Appeal_From_Case_Number_Name=617/2025
|Appeal_From_Status=
|Appeal_From_Link=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=ds
|
}}

The Supreme Administrative Court upheld a ruling requiring the DPA to reconsider a CCTV complaint, finding that it had not justified treating two cameras differently or shown how filming part of the data subject’s yard served a legitimate interest.

== English Summary ==

=== Facts ===
A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that a camera had been mounted on a metal structure on a third-floor terrace of the neighbouring building and installed in a manner that extended into the space above her property. According to the data subject, the camera had the technical capacity to identify individuals and objects throughout her property.

The controller did not deny installing the camera but argued that it was directed towards the fence and an outbuilding on his own property. He also stated that a second camera had been installed on the western façade of the building. The controller claimed that both cameras were used solely to monitor his own property and the processing was lawful under the GDPR. 

The DPA carried out an on-site investigation and found that the CCTV system consisted of two independent cameras operated through separate software applications. Both cameras could be rotated in all directions and could use an automatic tracking function. The recordings were stored on memory cards for approximately 15 days before being automatically deleted, and only the controller had access to the system. The DPA noted that Camera 1 recorded the northern part of the controller’s yard, his house and the fence bordering the data subject’s property and Camera 2 recorded the roof of the controller’s house and a small part of the data subject’s yard. The DPA reviewed the oldest available footage and noticed that Camera 2 had recorded the data subject’s house and yard. The inspection report stated that the system could process personal data relating to individuals on both properties, but did not allow the identification of individuals or facial recognition. The DPA pointed out that warning stickers informing individuals of the video surveillance were displayed at the property. It found the complaint well founded in relation to Camera 1 and established a violation of [[Article 5 GDPR|Article 5(1)(c) GDPR]], for which it issued an official warning to the controller. However, it found the complaint unfounded in relation to Camera 2, considering that the surveillance was permissible on the basis of the controller’s legitimate interest in protecting his property.

The data subject appealed the part of the decision concerning Camera 2. The court of first instance annulled that part of the DPA’s decision and remitted the case to the DPA for reconsideration. It found that the DPA had relied entirely on the findings of the inspection team without carrying out a thorough, objective and independent examination of the relevant facts. 

Both the DPA and the controller appealed that judgment before the Bulgarian Supreme Administrative Court. 


=== Holding ===
The Supreme Administrative Court rejected the appeals and upheld the judgment of the court of first instance.

The court noted that Camera 2 recorded the roof of the controller’s building and part of the data subject’s yard. It further pointed out that the DPA had found that, due to their technical characteristics, both cameras could alter their surveillance coverage and process personal data relating to individuals on both properties, while the CCTV system allowed individuals to be identified. 

Moreover, the court agreed with the first-instance court that the DPA had failed to provide adequate reasons for treating the two cameras differently. In particular, the DPA had not explained how the partial recording of the data subject’s yard contributed to the protection of the controller’s legitimate interest in safeguarding his property. It determined that it had also failed to establish whether adjusting the field of view of Camera 2 could expand its recording perimeter and allow it to capture a larger part of the data subject’s property.


== Comment ==
''Share your comments here!''

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

<pre>
The proceedings are conducted pursuant to Article 208 et seq. of the Administrative Procedure Code (APC) in connection with Article 38(6) of the Personal Data Protection Act (PDPA).The case was initiated based on two appeals.The first of these was filed by the Commission for Personal Data Protection (CPDP), through its legal representative, against Decision No. 3754 of September 26, 2025, rendered in Administrative Case No. 617/2025 of the Stara Zagora Administrative Court, which, upon an appeal by Zh. I. R., annulled Decision No. PPN-01-439/2023 dated April 2, 2025, of the CPDP, in the part in which the complaint filed by R., ref. No. PPN-01-439/May 31, 2023, was declared unfounded with respect to the operation of video camera No. 2, regarding which it was alleged that unlawful processing of personal data had taken place, and the case file was remanded to the administrative authority for a new decision.The decision is being challenged by an appeal to the Court of Cassation, filed through legal counsel, by S. K. K. as well.Both appeals allege that the decision is incorrect and unlawful. The appellants seek its reversal and the issuance of a new decision on the merits of the dispute, which should uphold the decision of the Commission for Personal Data Protection.The respondent, Zh. I. R., has not commented on the appeal.The representative of the Supreme Cassation Prosecutor's Office concludes that the cassation appeals are well-founded.This court finds the appeal to be procedurally admissible, as it was filed within the prescribed time limit and by the proper party. Upon reviewing the merits of the case, it has determined the following:In reaching this legal conclusion, the court found that the contested decision of the Commission for Personal Data Protection was issued in the form prescribed by law; the grounds—both factual and legal—for the decision were stated; and the conclusions reached by the authority were set forth, along with their corresponding legal characterization.The court, however, finds that, in light of the reasons set forth by the authority, which are consistent with the evidence in the administrative record, there has been a material violation of the rules of administrative procedure related to non-compliance with Articles 35 and 36(1) of the Administrative Procedure Code. The court concludes that the decision of the Commission for Personal Data Protection, in the contested part, was issued without fully clarifying all facts and circumstances relevant to the case. The material procedural violations committed also led to a violation of substantive law.These findings by the court of first instance are based on the following facts:Administrative proceedings before the Commission for Personal Data Protection (CPDP) have been initiated in connection with a decision—referred to the CPDP due to jurisdiction—to refuse to initiate a pre-trial investigation on the docket of the Stara Zagora Regional Prosecutor’s Office, including a complaint and case materials under case No. No. 1959000-4584/March 7, 2023, on the docket of the 1st Police Precinct in Stara Zagora, registered with the CPDP under No. PPN-01-439/May 31, 2023. The complaint itself contained allegations of unlawful processing of the personal data of the complainant, Zh. R., by S. K., through the use of video surveillance, via a video camera mounted on a metal railing on a terrace on the third and top floor of the building located to the north of her property. According to R., the device was installed in such a way it extends vertically into the space above her own property and possesses the technical capabilities to identify individuals and objects throughout the entire area of that property, which substantially infringes upon her rights. Attached to the complaint is photographic evidence revealing specificthe exact location of the camera in question. Among the materials forwarded to the competent authority, a statement from K. was found in which he does not deny the presence of a camera installed on his own property, stating that it is aimed at monitoring the property’s fence and the outbuilding on it, rather than his neighbors’ property. It is argued that there is, in fact, a legal basis for the processing of personal data, and that the processing itself is lawful and permissible within the meaning of Regulation (EU) 2016/679. The complainant’s allegations regarding targeted video surveillance on her own property are entirely denied. It is also noted that a second camera is installed on the western facade of the building, and that it, too, was installed for the sole purpose of recording K.’s own property.It has been established that on March 25, 2024, an inspection team from the Commission for Personal Data Protection (CPDP) conducted an on-site visit to the specified address, an inspection report was drawn up on the same date, signed by the inspectors and by S. K., which details the circumstances established by the inspectors and to which photographic evidence is attached. The inspectors’ findings are that the property in question consists of a yard and two buildings erected on it: a three-story residential building with one apartment per floor and a two-story house. K. is the owner of an apartment in the residential building and of the two-story house. R.’s property borders on the north side, with the two properties separated by a solid brick fence, as well as by the house owned by K., whose northern side is exactly on the boundary between the two properties. The video surveillance system consists of two cameras (with technical specifications detailed in the report), both of which are independent of one another and are monitored and controlled via separate software applications. As evident from the descriptionOh, the cameras allow for adjusting the video surveillance coverage, as they can be rotated in all directions, including when the automatic tracking function is enabled, via the corresponding software application. The system records and stores video footage on a memory card for approximately 15 days, after which the recordings are automatically deleted in the order in which they were recorded. Only K., who is the owner of the system, had access to it, and he was the one who installed it. Camera No. 1 was mounted on a metal structure on a shared terrace on the third floor of the residential building and captures the northern part of the property’s yard, K.’s house, and the fence bordering the complainant’s property. Camera No. 2 was also mounted on a metal structure on the third floor and filmed the roof of K.’s house and a small portion of R.’s yard. The report states that “upon reviewing the oldest footage from the cameras, it was determined that Camera No. 2 had recorded the house and yard of the appellant’s property.” It is noted that uponThrough this system, personal data of individuals could be processed at both properties; however, the system does not allow for the identification of individuals or facial recognition. No security services were provided at the property by another natural or legal person in accordance with the Private Security Services Act. Information stickers warning of video surveillance at the address were found to be in place. S. K. did not provide any documents regarding the processing of personal data through the installed system.It was also established that, during the proceedings, information was requested from the Stara Zagora District Prosecutor’s Office regarding Prosecutor’s File No. 11652/2021 on the docket of the Stara Zagora District Prosecutor’s Office, in response to which a reply was received stating that the investigation in the initiated pretrial proceedings had not been concluded, and therefore a copy of the final prosecutorial act could not be provided. The subject of the proceedings is the unauthorized but unlawful demolition of a fence between the two properties. In the administrative proceedings, K. submitted additional written evidence, including a notarial deed, a plot sketch, a court decision issued by the Stara Zagora District Court, a medical report, and others. An additional statement was also submitted by the individual, in which it is again asserted that the conditions for the lawful processing of personal data are met.The Commission for Personal Data Protection (CPDP) issued the partially contested Decision No. PPN-01-439/2023 dated April 2, 2025, and, pursuant to Article 38(3) of the Personal Data Protection Act, in point 2, it declared R.’s complaint against S. K. to be unfounded in the part concerning surveillance camera No. 2. In the decision, the complaint regarding camera No. 1 was declared well-founded; in this regard, a violation of Article 5, § 1, letter “c” of Regulation (EU) 2016/679 was established, and pursuant to Article 58, § 2(b) of the Regulation, the Commission imposed a corrective measure—an official warning to S. K.—that the data processing operations carried out via Camera No. 1 had violated the provisions of the applicable legislation.R. has challenged the decision of the Commission for Personal Data Protection (CPDP) to the extent that it dismissed her complaint as unfounded with respect to camera No. 2. To overturn that part of the decision, the court of first instance held that the administrative authority had based its decision entirely on the factual findings of the inspection team, without conducting a thorough and objective independent review and analysis of the relevant facts.The court's conclusions are correct and in accordance with the law.It is an indisputable fact that the camera in question, No. 2, is mounted on a metal structure on the terrace of K.’s residence, on the third floor of a residential building. Its field of view—as determined during the on-site inspection and based on the recorded footage—covers the roof of the building owned by K. and part of the yard of R.’s property. The administrative authority finds that both installed cameras, given their technical specifications, are capable of adjusting their video surveillance coverage; process personal data of individuals on both K.’s property and R.’s property, as the video surveillance system allows for the identification of individuals.This court fully concurs with the conclusion of the court of first instance that the administrative authority in no way provided grounds or justification for the approach it adopted in distinguishing between the video surveillance conducted by the two cameras- Camera 1—which captures the northern part of the property’s yard, K.’s house, and the fence bordering the appellant’s property—the appeal was succinctly found to be well-founded; Camera 2, which captures part of R.’s yard (described in general terms by the administrative authority as “small”) but allows for the identification of individuals in the footage— it was accepted, uncritically and without justification, that the filming carried out with this camera is permissible for the purposes of the controller’s legitimate interest—the protection of his property and assets. The Commission for Personal Data Protection does not specify how the partial recording of R.’s yard contributes to the protection of K.’s legitimate interest. In this case, it has not been established whether the permissible change in the scope of recording by Camera No. 2 allows for an expansion of its recording perimeter and scopepossession and the majority of R.'s property.These questions should be addressed during the new review of the case file.In light of the foregoing, this panel of the Supreme Administrative Court finds that the appealed decision is correct and should be upheld, as it was rendered in the absence of grounds for reversal on appeal.The court is not required to rule on the costs before the court of cassation, as no such request has been made by the defendant.In light of the foregoing, the Supreme Administrative Court, Fifth Division,RESOLVED:UPHOLDS Decision No. 3754 of September 26, 2025, rendered in Administrative Case No. 617/2025 of the Stara Zagora Administrative Court.This decision is not subject to appeal.
</pre>