On November 16, 2021, Bulgarian Supreme Administrative Court ruled in a case of Bulgarian Personal Data Protection Commission (the Commission) against electronic media. The case concerned a publication of personal data of an individual for the purposes of journalistic material. The decision outlined key criteria relevant for assessing the balance between the right to freedom of expression and information and the right to the protection of personal data that may become also relevant for the establishment of the future judicial practice on the matter.
The proceeding has been intiated by a compliant by a data subject submitted to Commission against an article in electronic media. The article disclosed information about the complainant's physical identity (three names, part of his unique national identification number/ date of birth, address), economic identity (property with the exact details of a property (home) owned by the complainant (e.g. as per the official property register and financial status, participation and membership in a non-governmental organization), social identity (profession, place of work, employment, affiliation information). The Commission has found that the compliant is justified, while the first instance court has ruled that there is no violation of the data protection rules since the article is a journalistic material and therefore the processing of personal data is lawful.
Thus, the Supreme Administrative Court as a cassational (final) instance has examined the case and found the complaint and the respective decision of the Commission justifiable. Within its motives the Supreme Administrative Court outlined several important arguments in support of its decision:
- Bulgarian Personal Data Protection Law provides provide for exceptions from a number of rules under GDPR, if a data processing is necessary for journalistic purposes (e.g. to reconcile the right to protection of personal data with freedom of expression and information). However, the law explicitly states that the processing should not affect the privacy of the personal life.
- Under Bulgarian law the exceptions for journalistic purposes do not affect the application of the principles under Art. 5 GDPR, incl. the data minimization principle. In the present case, the controller violated this principle because the balance between freedom of expression and the right to information and that of personal data protection was disturbed, as the need to inform the public about the facts can be satisfied without indicating the date of birth of the commented public figure and the exact number of his apartment and property identifier.
- The complainant is a public figure and his data were published for journalistic purposes, which makes their publication mostly lawful, in view of the right to information of the public, but this right would not be violated by deleting the entire PIN of the person and not publishing the apartment number and property identifier.
- Part of the information is available in a public register (the property register), but this register has different purposes than those of the publication for journalistic purposes. In addition, the data in the public register are not directly publicly available, but can be obtained under the specific rules.
Thus, the Supreme Administrative Court indicates that the processing of personal data for journalistic purposes is lawful only, if it is in balance with and does not affect unproportionally the privacy of the personal life. Such processing should comply with the data minimization priciple (and the other principles of Art. 5 GDPR). In addition, not every publicly available data is admissible to be used for journalistic purposes, but again such use should be compliant with the principles of Art. 5 GDPR.
Article provided by INPLP member: Desislava Krusteva (Dimitrov, Petrov & Co., Bulgaria)
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)
