Bulgaria / Supreme Administrative Court / 7423/2020

Mr A vs the National Revenue Agency (NRA) (Национална агенция за приходите, НАП)
Deciding body type
National Court/Tribunal
Deciding body
Supreme Administrative Court
Typ
Decision
Decision date
20/08/2020

Charta der Grundrechte der Europäischen Union

Title II: Freedoms

Article 8 - Protection of personal data

VIEW FULL CASE
  • Bulgaria / Supreme Administrative Court / 7423/2020
    Key facts of the case:
    1. the facts of the case (so the “real life story”) 2. the legal background against which the case unfolded (what are the relevant legal norms that are applied) The case concerned one of a number of claims for damages raised by citizens in relation to a massive leak of personal data from the National Revenue Agency (NRA) (Национална агенция за приходите, НАП). A Mr A appealed the ruling of the lower administrative court (Sofia City Administrative Court (Административен съд – София град)), by which his claim for BGN 1,000 (appr. € 500) for non-pecuniary damage against the National Revenue Agency (NRA) (Национална агенция за приходите, НАП) for insufficient protection of his personal data was returned as inadmissible and the proceedings were terminated. The lower instance had ruled that the claimant only claimed compensation for non-pecuniary damage and did not appeal specific actions by the Agency related to giving unlawful access or distributing unlawfully his personal data. However, according to the Personal Data Protection Act (Закон за защита на личните данни), damage can only be claimed if unlawful actions are established, thus the claim was inadmissible. The Supreme Administrative Court (SAC) (Върховен административен съд, ВАС) recalled the primacy of international and EU law before national norms, which contradict them, and made a detailed overview of protection of personal data under EU law, including the right to effective remedy against violations and compensation for damage incurred. As a result of the overview, SAC established that there is no need to formally establish the unlawfulness of the action for damages to be claimed – this would be a limitative condition which has no legal basis. There were no concurring proceedings before the Commission for Personal Data Protection (CPDP) (Комисия за защита на личните данни, КЗЛД) involving the same claimant either, but just a general decision by which the Commission imposed measures and a pecuniary sanction on the Revenue Agency.
    Key legal question raised by the Court:
    The court had to discuss whether the formal establishment of unlawful action by the Revenue Agency was a prerequisite for a claim by a person for damages, related to insufficient protection of their personal data.
    Outcome of the case:
    The ruling of the lower court was revoked and the case was returned for further deliberations.
     
     
     
  • Paragraphs referring to EU Charter

    According to Art. 4, para. 3 of the Constitution, the Republic of Bulgaria participates in the establishment and development of the European Union, and by virtue of Art. 5, para. 4 of the Constitution, the international treaties, ratified by constitutional order, promulgated and entered into force for the Republic of Bulgaria, are part of the domestic law of the country. They have primacy over those norms of domestic law that contradict them. In view of this, the rights of subjects laid down in the Treaty on European Union and in the Treaty on the Functioning of the European Union take precedence over provisions of national law which are contrary to them. The same applies to the Charter of Fundamental Rights of the European Union (Charter), which under Article 6 (1) TFEU has the same legal force as the Treaties. Article 8 (1) of the Charter and Article 16 (1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of his or her personal data. The protection of individuals with regard to the processing of personal data is a fundamental right. Rules on the protection of individuals with regard to the processing of personal data, as well as the protection of fundamental rights and freedoms of individuals, and in particular their right to the protection of personal data, are laid down in Regulation (EU) 2016/679. Pursuant to Article 288 (2) TFEU, a regulation is an act of general application which is binding in its entirety and directly applicable in each Member State.

     
  • Paragraphs referring to EU Charter (original language)

    Съгласно чл. 4, ал. 3 от Конституцията, Република България участва в изграждането и развитието на Европейски съюз, а по силата на чл. 5, ал. 4 от Конституцията, международните договори, ратифицирани по конституционен ред, обнародвани и влезли в сила за Република България, са част от вътрешното право на страната. Те имат предимство пред тези норми на вътрешното законодателство, които им противоречат. С оглед на това регламентираните в Договора за Европейския съюз и в Договора за функциониране на Европейския съюз права на правните субекти имат предимство пред норми на вътрешното право, които им противоречат. Същото важи и за Хартата на основните права на Европейския съюз (Хартата), която по силата на член 6, параграф 1 ДФЕС има същата юридическа сила като договорите.

    Член 8, параграф 1 от Хартата на основните права на Европейския съюз (Хартата/ХОПЕС) и член 16, параграф 1 от Договора за функционирането на Европейския съюз (ДФЕС) предвиждат, че всеки има право на защита на личните му данни. Защитата на физическите лица във връзка с обработването на лични данни е основно право. Правилата по отношение на защитата на физическите лица във връзка с обработването на лични данни, както и защитата на основни права и свободи на физическите лица и по-специално тяхното право на защита на личните данни, са определени в Регламент (ЕС) 2016/679. На основание член 288, параграф 2 ДФЕС регламентът е акт с общо приложение, който е задължителен в своята цялост и се прилага пряко във всяка една държава членка.