Court case 2984/2026 – Court Ruling (Bulgaria, 2026)

Court Ruling
DPA AdministrativeCourto13 October 2026Bulgaria
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

A Bulgarian court ruled that a financial institution must provide a person with copies of their personal data after they requested it. The company had only given a summary instead of the full documents, which is against the law. This case emphasizes the right of individuals to access their personal information and the obligations of companies to comply with such requests.

What happened

A Bulgarian financial institution failed to provide a person with copies of all documents containing their personal data as requested.

Who was affected

A person who requested access to their personal data from a Bulgarian non-banking financial institution.

What the authority found

The Administrative Court ruled that the financial institution violated the individual's right to access personal data under GDPR and ordered them to fulfill the request properly.

Why this matters

This ruling reinforces the right of individuals to access their personal data and holds companies accountable for complying with such requests. It serves as a reminder for businesses to ensure they have proper processes in place for data access requests.

GDPR Articles Cited
Automatically processed
Art. 15(1) GDPR
Art. 15(3) GDPR
Art. 23(1)(i) GDPR
View original scraped data
Art. 15(1) GDPR
Art. 15(3) GDPR
Art. 23(1)(i) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Decision AuthorityBulgarian Supreme Administrative Court
Reviewed AuthorityAdministrative Court of Lovech(Bulgaria)

Source checks

Secondary-source text retrieved.

Automated check recorded — 15 October 2026.

Processing notes: authority corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676/2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that Article 15(3) GDPR requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487/2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case 2984/2026 in BG

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

13 October 2026

Authority

DPA AdministrativeCourto

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Court case 2984/2026 - Bulgaria (2026). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: