CPDP (Bulgaria) - Teachers "blacklist"

CPDP - Teachers "blacklist"
Authority:	CPDP (Bulgaria)
Jurisdiction:	Bulgaria
Relevant Law:	Article 6(1)(a) GDPR
Type:	Investigation
Outcome:	n/a
Started:
Decided:	10.03.2025
Published:	10.03.2025
Fine:	n/a
Parties:	n/a
National Case Number/Name:	Teachers "blacklist"
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Bulgarian
Original Source:	CPDP (in BG)
Initial Contributor:	Vicky Datsova

The Bulgarian CPDP stated that personal data posted on social media by the organizer constitutes valid consent under GDPR Art. 6(1)(a) for processing by others, as the data subject voluntarily submitted the data to the petitioner.

English Summary

Facts

A group of teachers signed a petition opposing proposed amendments to the Law on Preschool and School Education (LPSE). The petition, which included the names, job titles, and workplaces of 26 teachers, was publicly posted on the petition organizer on his Facebook account. Members of the political party "Vazrazhdane," which initiated the legislative proposal, extracted the personal data from the petition and republished it as a “blacklist” on the party’s official Facebook page. The individuals were labeled as opposing the ban on “LGBTQ propaganda in schools and childcare institutions.” According to a Facebook post by party leader Kostadin Kostadinov, the blacklist was intended to inform parents about who is teaching their children. He also stated that "Vazrazhdane" would file a complaint against those teachers with the Prosecutor's Office. Following media reports, the Bulgarian Commission for Personal Data Protection (CPDP) initiated an ex officio investigation. Based on the facts established and the written evidence gathered, the CPDP confirmed that the personal data of 25 of the 26 individuals included in the so-called blacklist matched data from one of the publicly available petitions on Facebook.

Holding

It is evident from the content of the petitions that individuals who provide their personal data in support explicitly agree or decline to have their data published in full or using only initials. Therefore, the processing of their data is lawful and in accordance with Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council.

Comment

CPDP opinion is fundamentally wrong. With this opinion, the CPDP advanced a dangerously flawed interpretation of data protection law, effectively asserting that once a data subject’s personal data is made public on social media, any third party is free to further process and repurpose it — even in ways that harm the data subject. This stance not only undermines the core principles of lawfulness, fairness, transparency, purpose limitation, and accountability under the GDPR, but also risks legitimizing harmful and stigmatizing uses of personal data under the guise of public availability. Such a position is not only legally incorrect — it is fundamentally incompatible with the protective intent of the GDPR.

Article 4(11) of the GDPR defines consent as: “any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her – for the purpose the consent was given. Making data publicly available does not equal to consent per GDPR because does not meet these criteria.

Teachers provided their personal data solely to the petition organizer, who published the petition on his own Facebook page. They did not gave valid consent for their data to be included in “Vazrazhdane’s” blacklist or to be publicly posted on the party’s official Facebook page.

The processing also violated the fairness principle under the GDPR, which requires that personal data be processed only: (1) in ways the data subjects can reasonably expect, and (2) not in ways that cause unjustified adverse effects. In this case, data subjects could not have reasonably expected their personal data to be taken and republished in a “blacklist” by a third party. This action undeniably caused unjustified harm to those individuals. The blacklist was used as a tool of public shaming for opposing the proposed amendments to the Law on Preschool and School Education, which had been politically framed as a ban on "LGBTQ propaganda in schools and childcare institutions." Therefore, even if data subjects had given consent (which they did not), such processing would still contravene the GDPR, as data subjects cannot lawfully consent to processing that inherently violates the regulation itself—particularly the principle of fairness.

Further Resources

https://www.edpb.europa.eu/system/files/2023-02/edpb_03-2022_guidelines_on_deceptive_design_patterns_in_social_media_platform_interfaces_v2_en_0.pdf?utm_source=chatgpt.com p. 47.

English Machine Translation of the Decision

The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details.

In connection with the publication of a "black list" of teachers from Varna educational institutions supporting a petition against the implementation of the latest amendments and supplements to the Preschool and School Education Act
10.03.2025

In connection with information published in the media about a violation of the rules for the protection of personal data by publishing on the page of the "Vazrazhdane - Varna" profile on the social media Facebook a "black list" of teachers from Varna educational institutions supporting a petition against the implementation of the latest amendments and supplements to the Preschool and School Education Act (PSEA) and a similar signal received, the Commission for Personal Data Protection (CPDP) has taken action to conduct an investigation into the case.

After actions were taken to establish facts and circumstances in the case, official inquiries were made on the Internet regarding publications concerning the organization of a petition against the implementation of the latest amendments and supplements to the ZPUO and the preparation of lists of persons supporting it, as well as statements were requested from the affected persons.

It has been established that in the media space in August 2024, 3 petitions were organized against the implementation of the latest amendments and supplements to the ZPUO (2 petitions organized by Boris Iliev - a lecturer at the National School of Natural Sciences and Mathematics "Acad. Lyubomir Chakalov", Sofia and 1 open letter organized by Stanimir Panayotov and Stoyo Tetevenski). The petitions are directed to different categories of individuals:

– lecturers, scientists, doctoral students and employees in the Bulgarian higher education and scientific system;

– pedagogical specialists from various educational institutions in the Republic of Bulgaria and

– teachers and parents.

It is evident from the content of the signatures that the persons who provide their personal data in their support explicitly agree or not to have their data published in full or with initials only, which is why the processing of their data is lawful and in accordance with Article 6, §1, letter "a" of Regulation (EU) 2016/679 of the European Parliament and of the Council.

It has been established that electronic media are also disseminating information that the organization of the PP "Vazrazhdane" in the city of Varna has published a list with the names, subjects taught and jobs of teachers and school principals from the city of Varna who have signed a list against the legal ban on LGBT propaganda in schools and kindergartens, aimed at informing parents about what kind of teachers teach their children. And on his Facebook profile, Kostadin Kostadinov announces that "Vazrazhdane" will file a report with the prosecutor's office on this occasion. From the media publications it was established that the distributed short list contains two names, place of work and subject taught of a total of 26 persons working in Varna schools, a school and an educational center.

In their statement, the PP "Vazrazhdane" indicates that on 18.08.2024 the municipal organization of the PP "Vazrazhdane" in the city of Varna received access to the public list from the Facebook page of the initiator of the petition Boris Iliev, where the link for free download was also published. The names cited in the short list are part of the list prepared and published in the above-mentioned petitions, and all the above-mentioned access links were duly published on the Vazrazhdane-Varna page.

In the light of the factual situation thus clarified and from the written evidence collected, it has been established that the list disseminated in the media, containing 26 teachers and employees in Varna educational institutions as categories of individuals (teachers) and categories of personal data (2 names, position and workplace) coincides in structure with that of the Signature "Position of Bulgarian Teachers against the Amendments to Art. 11 of the Preschool and School Education Act", initiated by Boris Iliev. It has also been established that the data of 25 out of a total of 26 persons from the "black list" are present in the signature initiated by Boris Iliev. The persons who provided their personal data in support of the signatures have voluntarily entered their data in them and have expressly consented to their data being made public, therefore the processing of their data appears to be lawful and in accordance with Art. 6, §1, letter "a" of Regulation (EU) 2016/679.