You are here:

Bulgaria / Supreme Administrative Court / 7423/2020

Mr A vs the National Revenue Agency (NRA) (Национална агенция за приходите, НАП)

Deciding Body type:
National Court/Tribunal
Deciding Body:
Supreme Administrative Court
Decision date:
Key facts of the case:
1. the facts of the case (so the “real life story”) 2. the legal background against which the case unfolded (what are the relevant legal norms that are applied) The case concerned one of a number of claims for damages raised by citizens in relation to a massive leak of personal data from the National Revenue Agency (NRA) (Национална агенция за приходите, НАП). A Mr A appealed the ruling of the lower administrative court (Sofia City Administrative Court (Административен съд – София град)), by which his claim for BGN 1,000 (appr. € 500) for non-pecuniary damage against the National Revenue Agency (NRA) (Национална агенция за приходите, НАП) for insufficient protection of his personal data was returned as inadmissible and the proceedings were terminated. The lower instance had ruled that the claimant only claimed compensation for non-pecuniary damage and did not appeal specific actions by the Agency related to giving unlawful access or distributing unlawfully his personal data. However, according to the Personal Data Protection Act (Закон за защита на личните данни), damage can only be claimed if unlawful actions are established, thus the claim was inadmissible. The Supreme Administrative Court (SAC) (Върховен административен съд, ВАС) recalled the primacy of international and EU law before national norms, which contradict them, and made a detailed overview of protection of personal data under EU law, including the right to effective remedy against violations and compensation for damage incurred. As a result of the overview, SAC established that there is no need to formally establish the unlawfulness of the action for damages to be claimed – this would be a limitative condition which has no legal basis. There were no concurring proceedings before the Commission for Personal Data Protection (CPDP) (Комисия за защита на личните данни, КЗЛД) involving the same claimant either, but just a general decision by which the Commission imposed measures and a pecuniary sanction on the Revenue Agency.
Key legal question raised by the Court:
The court had to discuss whether the formal establishment of unlawful action by the Revenue Agency was a prerequisite for a claim by a person for damages, related to insufficient protection of their personal data.
Outcome of the case:
The ruling of the lower court was revoked and the case was returned for further deliberations.