Author: Preslav Baldzhiev
The implementation of the General Data Protection Regulation (GDPR) has provided greater security and more comprehensive protection for individuals and their personal data. In fulfillment of its obligations under GDPR, each EU Member state has set up an independent public supervisory authority to monitor the implementation of the European legislation. For the Republic of Bulgaria, such authority is the Commission for Personal Data Protection (CPDP/Commission).
What is the CPDP?
The CPDP is a permanent independent collective supervisory authority that protects individuals in the processing and accessing of their personal data. Additionally, the Commission monitors compliance with the Bulgarian and European legislation in the field of personal data. The CPDP is chaired by a chairman and the members of the Commission met in an open session.
Any individual has the right to file a complaint to the CPDP if the individual considers that the processing of personal data concerning him/her violates the provisions of the Regulation.
In what term can protection be sought from the CPDP and in what way?
The individual shall have the right to bring the said infringement to the attention of the Commission within six months after becoming aware of the infringement but not later than two years after the said infringement is committed. This right is exercised by the filing of a signal or a complaint. The signal or complaint may be filed as follows, namely:
- Personally, in the office of the CPDP;
- By mail or courier;
- By fax – it shall be sent to 02/9153525;
- By e-mail;
- By the Security Electronic Service System.
Filing a signal/complaint personally or by mail/courier
If the individual wishes to submit the signal and/or complaint personally, he/she shall file the signal/complaint in the Office of the CPDP, which is located at: Sofia 1592, Blvd. Tsvetan Lazarov ”№ 2.
If the individual wishes to file the signal/complaint by mail or courier, the signal/complaint shall be sent to the address indicated in the previous sentence and the Commission shall be indicated as the recipient.
Filing a signal/complaint electronically
The CPDP provides two ways of filing signals and/or complaints electronically.
The first option is to send a signal/complaint to the Commission by e-mail (kzld@cpdp.bg) – the complaint shall be formatted as an electronic document (simply written in Microsoft Office Word), and the document shall be signed with an electronic signature. The CPDP will not accept a scanned copy of the complaint.
There are no such requirements when filing a signal – the signal can be sent as an email. The email shall include the sender’s name, contact information, and the content and nature of the signal.
The second option for filing a signal/complaint electronically is by Secure Electronic Service System (https://edelivery.egov.bg/). To use the System, the individual shall register an account. When an individual registers an account, he/she shall verify the identity by electronic signature or Personal Identification Code (PIC) of the NSSI. The use of one of the two ways of verification is mandatory to complete the registration.
What the signal/complaint should contain?
Regardless of the method of filing, the signal/complaint has a standard content. The mandatory content is the name, address, and telephone number of the individual, nature of the signal/complaint, date, and signature. If necessary, the author of the signal/complaint may attach additional information or documents that are relevant to the specific case, as well as use an electronic signature if the individual files a signal/complaint electronically.
Procedure and Judicial Protection
Within three months of the filing of the complaint, the Commission shall inform the individual of the progress in examining the complaint. The CPDP shall give its pronouncement by way of a decision within that three-month period and a copy of the decision shall be sent to the individual. The decision may be appealed under the procedure of the Administrative Procedure Code (APC) within 14 days of its receipt.
It is important to note that in the event of any infringement of his/her rights related to the protection of personal data, the individual may appeal any actions before the court under the procedure of the APC. In this case, it is not necessary to file a complaint to the Commission. The individual may not bring a breach to the attention of the court if proceedings in connection with the same infringement are pending before the Commission or a decision of the Commission regarding the same infringement has been appealed and there is no enforceable judgment of the court.
This material prepared by Preslav Baldzhiev aims to provide more information about the submission of a signal and a complaint before the Commission for Personal Data Protection in Bulgaria. It does not constitute a legal opinion and cannot be interpreted as individual consultation on any concrete facts or circumstances. The advice of a specialist should be obtained for specific questions and situations. For more information on the above-mentioned issues and individual consultations, please contact the team of the law firm of Krasimira Kadieva at 00359 882 308 670 or make an inquiry using the contact form of the website. Since 2017 Preslav Baldzhiev is a law student at Sofia University “St. Kliment Ohridski “, having previously graduated from the High School of mathematics and natural science “Acad. Nicola Obreshkov” in Burgas. In February 2020 he took a course for industrial property representatives at the Patent Office of the Republic of Bulgaria in the field of trademarks, geographical indications, and industrial designs. He is interested in intellectual property, personal data protection, commercial and law on obligations and contracts and also regularly attends conferences, practical courses, seminars, and webinars.