Mr. Y.L. – €1,020 Fine (Bulgaria, 2020)

The Bulgarian DPA examined a complaint lodged by a citizen against a political party for unlawful processing of his personal data (names and personal number). The data were included in a list of supporters prepared by the political party. This type of list is a mandatory legal requirement for a person to be registered as a candidate in the elections for Bulgarian members of the European Parliament, conducted in Bulgaria on 26th May 2019. The data subject claimed that he noticed the violation after he submitted an electronic inquiry before the Central Election Commission on 27th April 2019. He claims that he did not sign in any list in support of the registration of the person as a candidate in the elections and he did not give his consent to the processing of his personal data. The data subject considered the presence of his personal data in the abovementioned list as a violation of his rights. The political party claimed that the data subject's personal data was lawfully processed on the ground of his explicit consent, which they claimed he gave by signing the list with supporters. In addition, the political party claimed that the data subject is not a member of the party and his personal data have not been previously processed. The Bulgarian DPA decided that the complaint against the political party is founded and imposed a fine of BGN 2000. The provision of personal data by a political party to the Central Election Commission for the purposes of a registration of a candidate in the elections for Bulgarian members of the European Parliament is a form of personal data processing and as such shall be lawfully performed in accordance with of Art. 6, para. 1 of the GDPR. For the purposes of clarification of the case from a legal and factual point of view, the Bulgarian DPA requested a handwriting expertise of the complainants’ signature to be conducted. After examining both signatures (the one on the list of supporters and the one given by the data subject), t