You are here:

Bulgaria/ Supreme Administrative Court/ [2019] 11036/2017

Association Civic Control – Animal Protection (СНЦ „Граждански контрол – защита на животните“) and Mr G.S. vs Ms A.D.

Deciding Body type:
National Court/Tribunal
Deciding Body:
Supreme Administrative Court
Decision date:
05/08/2019

Key facts of the case:

Ms A.D. claimed a violation of the Protection of Personal Data Act (Закон за защита на личните данни) because her personal data – full name – was visible and accessible to anyone on a Bulgaria-based website, owned by a Bulgarian citizen. The website was processing data from case-law on the Access to Public Information Act (Закон за достъп до обществена информация). The website, based on pre-defined parameters, gathered information from the website of the Supreme Administrative Court (Върховен административен съд) on cases related to the application of the Access to Public Information Act (Закон за достъп до обществена информация). It was first developed as a search engine for internal use by an NGO, but was then made public to allegedly overcome the ‘faults’ of the Court’s website own search functionalities. The search engine followed and analysed the number of cases, regarding access to public information, and citizens’ related procedural activities, thus, giving allegedly unlimited possibilities to identify any person, without their consent , and show their activity or passiveness in such cases, thus going beyond the public information on the Court’s website. The applicant’s personal data appear in the case law the website shows without her having given consent to the owner to process such data. After several rounds between the Commission for Personal Data Protection (CPDP) (Комисия за защита на личните данни, КЗЛД) and administrative courts, the case ends up before the Supreme Administrative Court (SAC) (Върховен административен съд, ВАС) for a second time

Key legal question:

The court agrees that the main issue of dispute is whether the transmission of personal data from one website (source) to another is a violation of Art. 2 of the Personal Data Protection Act (Закон за защита на личните данни).

Outcome of the case:

The court confirms the lower instance’s decision and finds a violation of the personal data protection regime. This conclusion was reached despite the claim that the website was performing a journalistic activity – the court found this was only a technical activity, which, however, was related to wrongful publicisation of personal data.