Skip to main content

Bulgarian DPA on the Admissibility of Ongoing Access to Municipality’s Video Surveillance


Bulgarian DPA issued an opinion on the questions from a Bulgarian City Municipality regarding requested ongoing access from the police department to the video recordings of the Municipality video surveillance system.

Upon receiving a set of questions from one of the city municipalities Bulgarian DPA has issued a thorough opinion regarding the admissibility of granting ongoing access in real time to the video recordings of the video surveillance system of the municipality to the city police department for the purposes of their tasks related to operational-search, security, investigation and prevention of crimes, as well as effective protection of public order and countering conventional crimes.

Upon detailed legal analysis the DPA has concluded that at the moment there is no legal basis under the applicable legislation for granting permanent, ongoing and unrestricted access to the video surveillance system of the municipality to the city police department.

The current regulatory framework allows the provision of only specific records or time-limited access related to the exercise of police powers only, incl. under conditions of urgency, as well as requested in due course, and the same is realized according to criteria such as e.g. date, time, location, etc. These criteria contribute to guaranteeing the principles of limitation of purposes and data minimization under Art. 5 of Regulation (EU) 2016/679, as well as meet the requirements for disclosure of data laid down in Rec. 22 of Directive (EU) 2016/680.

The video surveillance carried out by the municipality falls within the scope of Regulation (EU) 2016/679, while the processing of the data received by the authorities of the Ministry of Internal Affairs (the police departments), in their capacity as a competent authority within the meaning of Art. 42, para. 4 of the Personal Data Protection Act (PDPA) video recordings, falls within the scope of Chapter VIII of the Personal Data Protection Act, which transposes the requirements of Directive (EU) 2016/680 into Bulgarian legislation.

The municipality and the authorities of the Ministry of Internal Affairs (the police department) process the video recordings for different purposes and on different legal grounds, which determines their roles as independent data controllers. The legal relationship "controller - processor" in this hypothesis is inapplicable, since the authorities of the Ministry of Internal Affairs (police department) do not process the data from the video recordings by assignment and on behalf of the municipality, but process them for the needs of exercising their powers granted to them by law.


Article provided by INPLP member: Desislava Krusteva (Dimitrov, Petrov & Co., Bulgaria)



Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)

Cloud Privacy Check (CPC). Data Privacy Compliance in the Cloud Made Easy

Understand Cloud and Data Protection Law in only 4 easy steps. Plus highly relevant legal information for 33 countries. Provided by EuroCloud and 53 European lawyers.


About Us

EuroCloud is an independent non-profit organization and consists of a two-tier setup where organisations form all European countries can apply to participate in as long as they respect the EuroCloud Statutes.

To act as a true European player, all programs that are developed are intended to be European activities. These European programs are the strength of EuroCloud as a whole. Respect to local cultures along with the will to promote a real European spirit.