Court case 2984/2026 – Court Ruling (Bulgaria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Bulgarian court ruled that a financial institution must provide a person with copies of their personal data after they requested it. The company had only given a summary instead of the full documents, which is against the law. This case emphasizes the right of individuals to access their personal information and the obligations of companies to comply with such requests.
What happened
A Bulgarian financial institution failed to provide a person with copies of all documents containing their personal data as requested.
Who was affected
A person who requested access to their personal data from a Bulgarian non-banking financial institution.
What the authority found
The Administrative Court ruled that the financial institution violated the individual's right to access personal data under GDPR and ordered them to fulfill the request properly.
Why this matters
This ruling reinforces the right of individuals to access their personal data and holds companies accountable for complying with such requests. It serves as a reminder for businesses to ensure they have proper processes in place for data access requests.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 15 October 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676/2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that Article 15(3) GDPR requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487/2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 2984/2026 in BG
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 2984/2026 - Bulgaria (2026). Retrieved from cookiefines.eu
Last updated: