Pursuant to the assignment of receivables (cession) agreement the creditor under a certain receivable (assignor) assigns it to a third party (assignee). Since the debtor is not a party tot he cession agreement quite often in the practice the debtor complaint for not been asked for permission his/ her personal data to be provided to the new creditor and/ or for not being aware that a third party will process his/her data.
Under Bulgarian legislation the debtor is not a party to the assignment agreement and their consent is not required for the transaction to take effect. However, as the effective performance of an assignment agreement requires and involves the provision of all the documentation regarding the reveivables to the new creditor and thus, the provision of the personal data of the debtor to the new creditor. Thus, the question on what legal basis applies to such provision of personal data has been subject to numerous disputes before Bulgarian DPA and in the past quite often a consent from the debtor was sought for the provision of their personal data to the new creditor.
However, the consent is an inappropriate legal basis for personal data processing under assignment agreements. This is explained by the fact that if processing is based on consent, it would allow the debtor to block the creditor from disposing of their receivables by preventing the creditor from processing the personal data contained in the debt documentation or debt related documents – information about who the debtor is and what his contact details are, where his obligation arises from, what is its amount and maturity, etc.
Therefore, other legal grounds may serve as basis for processing the debtor’s personal data.
The assignor may base its data processing activation on compliance with a legal obligation as the law obliges the assignor to provide the assignee with the debt documentation and thus, to perform the related processing of the personal data contained in this documentation. In addition, the assignor has a legitimate interest to dispose of its receivable as it deems appropriate.
The assignee, on the other hand, a legitimate interest to collect their receivable. In addition, the performance of a contract to which the data subject is a party also may serve as a legal basis, since the data subject is a party ynder the contract under which the assigned receivables have arisen. However, the last legal basis will apply if the assignment has lead an action against the debtor by notification under Art. 99, Para. 3 and 4 of the Contracts and Obligations Act.
According to more recent practical guidance by the Commission for Personal Data Protection (CPDP), the legal fact which makes the personal data processing admissible is the assignment of the receivable, not the notification of the debtor. This means that the assignee may lawfully process the debtor’s personal data even prior to this notification.
Finally, a key requirement to be fulfilled in case of an assignment is the notification of the debtor of the processing of their personal data. In case of cession the new data controller – assignee obtains the personal data not directly from the data subject, but from another source – the assignor. In order to ensure transparent data processing, the data subject needs to be provided with information under Art. 14 of the GDPR.
Article provided by: Desislava Krusteva and Martin Zahariev (Dimitrov, Petrov & Co., Bulgaria)
Discover more about INPLP, the INPLP-Members and the GDPR-FINE database
Dr. Tobias Höllwarth (Managing Director INPLP)
