DPA case Teachers "blacklist" – Violation Found (Bulgaria, 2025)

A group of teachers signed a petition opposing proposed amendments to the Law on Preschool and School Education (LPSE). The petition, which included the names, job titles, and workplaces of 26 teachers, was publicly posted on the petition organizer on his Facebook account. Members of the political party "Vazrazhdane," which initiated the legislative proposal, extracted the personal data from the petition and republished it as a “blacklist” on the party’s official Facebook page. The individuals were labeled as opposing the ban on “LGBTQ propaganda in schools and childcare institutions.” According to a Facebook post by party leader Kostadin Kostadinov, the blacklist was intended to inform parents about who is teaching their children. He also stated that "Vazrazhdane" would file a complaint against those teachers with the Prosecutor's Office. Following media reports, the Bulgarian Commission for Personal Data Protection (CPDP) initiated an ex officio investigation. Based on the facts established and the written evidence gathered, the CPDP confirmed that the personal data of 25 of the 26 individuals included in the so-called blacklist matched data from one of the publicly available petitions on Facebook. It is evident from the content of the petitions that individuals who provide their personal data in support explicitly agree or decline to have their data published in full or using only initials. Therefore, the processing of their data is lawful and in accordance with Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council.