The Supreme Administrative Court has given green light to the civil claims against the National Revenue Agency

In connection with the leakage of personal data from the National Revenue Agency (“NRA”) last summer, the Supreme Administrative Court (“SAC”) ruled in favor of the claims of citizens against the NRA, which had so far been suspended or terminated by the Administrative Court- Sofia City (“ACSC”).

The specific casе brought before the SAC was an appeal claim of a woman, pretending compensation for non-pecuniary damages in the amount of BGN 1,000.

So far, ACSC has terminated proceedings due to the disputed provision of Art. 39 of the Personal Data Protection Act (“PDPA”). Art. 39, para. 1 states that an individual whose personal data has been leaked improperly can appeal the actions and acts of the controller and the processor before the court. Para. 2 states that in such proceedings the individual may claim compensation for any damages, incurred as a result of the unlawful processing of personal data. The reason why ACCS dismissed the cases was that it bounded the procedure under para. 2 (claims for damages) with the one under para. 1 (appeal of the administrator’s actions), and namely ACSC justified the admissibility of the claim for damages (para 2) only when it was joined with the claim under para. 1 – appeal of actions and acts of the administrator.

Тhe case with the NRA, however, concerns a hypothesis of inaction – failure to fulfill an obligation to take the necessary measures to protect personal data, and therefore a claim under para. 1 to appeal against the actions of the NRA is not and cannot be brought by the citizens. In this regard, SAC decrees that the provision of Art. 39, para. 2 of the PDPA should be considered as an opportunity to join the two claims (para 1 and para 2) and not as an obstacle to their separate filing.

ACSC also justified a second obstacle, namely in relation to Art. 39, para. 4 of the PDPA. It states that an individualwhose personal data have been improperly processed cannot approach the court when there are pending proceedings before the Commission for Personal Data Protection („CPDP“) for the same violation or its decision on the same violation has been appealed and there is no decision of the court that has entered into force. This ruling is with regard to the issued Statement of Establishment of the Violation and the Penal Order by which CPDP fined the National Revenue Agency with BGN 5.1 million, which were appealed and have not entered into force. This, according to the ACSC, is an obstacle for reviewing claims for damages.

SAC, however, acknowledges that the existence of other administrative / judicial proceedings without the participation of the citizens in them, cannot constitute a procedural obstacle for the effective exercise of the personal right of access to court guaranteed by the General Data Protection Regulation (“Regulation”). Any different interpretation does not correspond to the right under the Regulation – individuals to have an effective remedy, including to be compensated for the alleged damage they suffered from the processing of their personal data.

301 total views, 1 views today