Court case 8426/2026 – Court Ruling (Bulgaria, 2026)

The data subject was a candidate for the position of senior legal counsel at the Bulgarian branch of the German commercial bank Flatex Degiro (the controller). As a prerequisite for entering into an employment relationship, the controller required her to submit a criminal record certificate. The data subject brought a damages claim before the Administrative Court of Sofia, seeking BGN 100 in compensation for non-material damage. She argued that the requirement to provide a criminal record certificate was unlawful and that the processing of the personal data contained in it lacked a legal basis. She alleged that this caused her psychological distress, discomfort and stress in the workplace. The controller argued that the requirement was justified by the nature of the position and the access to confidential information associated with it. It maintained that the unauthorised use of such information could lead to fraud and abuse. The Administrative Court dismissed the claim after finding that the processing of the data subject’s criminal record certificate was lawful under Article 6(1)(c) GDPR. It found that the applicable Bulgarian anti-money laundering legislation did not expressly provide for requesting a criminal record certificate at the time but rejected a formalistic approach requiring an explicit legal provision. It considered that the requirement followed from the purpose and overall framework of the anti-money laundering legislation and therefore found the processing lawful under Article 6(1)(c) GDPR. The data subject appealed this decision before the Bulgarian Supreme Administrative Court. The Bulgarian Supreme Administrative Court first noted that an Article 82 GDPR damages claim requires three cumulative conditions: an infringement of the GDPR, damage and a causal link between the infringement and the damage. It also held that the controller bore the burden of proving the lawfulness of the processing pursuant to Article 82(2) GDPR. It found that it had provided sufficient evidence that the processing was lawful. The court however did not base the lawfulness of the processing on a legal obligation under Article 6(1)(c) GDPR. The court agreed that requiring and reviewing the criminal record certificate constituted processing of personal data but found that the processing was lawful under Article 6(1)(f) GDPR. It considered that the controller had a legitimate interest in assessing the reliability of a senior legal counsel who would have access to confidential information, including client data, contracts, corporate documents and correspondence with banks and regulatory authorities. The court also considered the risk that such information could be misused for fraud or other abuses. The court found no infringement of the GDPR and upheld the dismissal of the damages claim. It further observed that the emotional distress alleged by the data subject appeared to result not from the processing of her personal data itself, but from the controller’s failure to accept her professional opinion that requesting the criminal record certificate was unlawful.