Court case 2984/2026 – Court Ruling (Bulgaria, 2026)

The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676/2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that Article 15(3) GDPR requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487/2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness of the processing of their data. Loan agreements, repayment schedules, credit applications, and related financial information may all contain personal data covered by this right. The BSAC clarified that access may be restricted to protect the rights and freedoms of third parties according to Article 23 GDPR#1]] GDPR. The controller had therefore to take care not to disclose personal data belonging to other individuals contained in the requested documents. However, no other applicable grounds for restricting access were established in this case. The Court noted that Article Article 23 GDPR]] establishes certain restrictions on the right of access to personal data. Since the controller had not invoked national security, defence, public security, or any of the other grounds for restriction listed in Article 23(1)(a)–(h) and (j), the only relevant limitation in this case was Article 23(1)(i), concerning the rights and freedoms of others. Accordingly, the controller had to protect the personal data of third parties and must not disclose personal data relating to other individuals if such data appears in the requested documents. This limitation did not, however, justify withholding the applicant’s own personal data contained in the requested documents. The BSAC therefore upheld the finding that the controller had failed to comply fully with its obligations under Article 15 GDPR]] by providing only an extract from its records instead of the requested document copies, subject to the necessary protection of third-party rights.