Borslav Tonchev – Court Ruling (Bulgaria, 2024)

A data subject was hired by the Chief Directorate for the Execution of Punishments (the Chief Directorate) as a prison guard in July 2004. This position required no prior convictions, sentences, or substitute administrative penalties. In the period between his application and hiring, the data subject was found administratively liable for driving under the influence of alcohol and was issued a substitute administrative penalty and fine by the Troyan District Court. In accordance with Bulgarian law, a record card for the penalty was stored in the Troyan District Court’s criminal records bureau. In August 2012, the data subject applied for a post in the Ministry of Justice directorate ensuring the security of the judiciary. The Ministry of Justice obtained a criminal report that included the data subject’s substitute administrative penalty and on the basis of that data, rejected the data subject from the post. The criminal record report was also sent to the Chief Directorate, which dismissed the data subject from his post as a prison guard as a result of the substitute administrative penalty. After learning of his rejection from the Ministry of Justice’s position, the data subject requested that the Troyan District Court destroy the record card in accordance with Regulation 31(1), which required record cards for substitute administrative penalties to be destroyed five years after the judgement imposing the penalty had become final. Judicial Complaint Challenging Dismissal: The data subject sought judicial review from the Sofia City Administrative Court concerning the dismissal from his employment a prison guard, claiming that the Chief Directorate obtained the data about his penalty unlawfully. He argued that criminal record reports could only be used for law enforcement purposes. The court dismissed the claim in February 2014. The data subject appealed the ruling. In February 2015, the Supreme Administrative Court upheld the lower court’s judgement, holding that under the law, prison officers with substitute administrative penalties had to be dismissed. It considered that the law did not require the data about the penalties to be obtained in any particular way, and thus dismissed the data subject’s arguments as irrelevant. DPA Complaint Challenging Unlawful Disclosure of Data: In November 2012, the data subject also filed a complaint with the Bulgarian DPA (CPDP) claiming that the Ministry of Justice processed his data unlawfully because the Troyan District Court had kept the record card for his penalty past October 2009 despite the expiry of the five year retention period under Regulation 31(1). The Ministry of Justice argued that the retention period applied only to the record cards, not to the data therein. The CPDP upheld the data subject’s complaint in June 2013, finding that the retention of the data by the Troyan District Court after the expiry of the five year retention period infringed section 2(2)(2) of the Protection of Personal Data Act of 2002, which required data to be collected for specified, clearly defined and lawful purposes. It thus found the Troyan District Court’s disclosure of the data subject’s record to the Lovech District Court unlawful and issued a fine on the district court. The Troyan District Court sought judicial review. The data subject also withdrew his complaint to the Commission because he had not directed his complaint against the Troyan District Court and did not agree with the CPDP’s findings against it. In November 2013, the Sofia City Administrative Court found the CPDP’s decision null and void on the basis that the Commission’s competence had retroactively disappeared given the withdrawal of the complaint. The Supreme Administrative Court upheld the judgment in November 2014, rejecting the CPDP’s appeal. It found that the CPDP had erred in fining the Troyan District Court because the data subject’s complaint had been directed solely against the Ministry of Justice. It also held that the Troyan District Court had processed the data subject’s criminal data lawfully because Regulation 31(1) only applied a five year retention period to the card. The data therein was subject to another regulation, Regulation 28(3), which noted that the earmarking of a card for destruction is to be recorded in the corresponding criminal records bureau’s alphabetical index without erasing the names of the people concerned and the related data from the index itself. ECtHR Appeal: In August 2015, the data subject applied to the European Court of Human Rights arguing that his data was unlawfully processed under Article 8 of the Convention of Human Rights (the right to respect for private and family life). He advanced two claims: # The disclosure of the criminal record card data in 2012-2013 was unlawful. # The retention of those data is unlawful. The ECtHR found that the retention of the data was not sufficiently foreseeable given ambiguity in Bulgarian regulations, resulting in a violation of Article 8(2) of the Convention. = The Court dismissed the data subject’s first claim of unlawful disclosure of criminal record data because it did not satisfy Article 35(1) of the Convention’s admissibility criteria – the appeal was not filed within six months from the date of the final decision. With regard to the second claim, however, the ECtHR found that ongoing retention was a continuing situation and thus complied with the six-month window under Article 35(1) of the Convention. The Court also noted that the second claim satisfied Article 35(3) of the Convention’s admissibility criteria, noting that the data subject was a victim of the ongoing violation and that, although the data subject did not suffer a significant disadvantage, the ongoing retention concerned respect for human rights and thus obligated an examination on the merits. = Conduct must meet three criteria to constitute a breach of Article 8(2) of the Convention. First, there must be an interference with the right to respect for private life. Second, the interference must not be justified. An interference is justified where it is “in accordance with the law,” pursues one or more legitimate aim and is “necessary in a democratic society” to attain the aim(s). The ECtHR noted that it is settled that the processing of data about criminal convictions and related measures concerns the private life of data subjects under Article 8 of the Convention, and that the processing of such data by authorities interferes with that right. This is the case even when the data are based on a court judgement delivered in public (citing E.B. and Others v. Austria; Biancardi v. Italy, no,. 77419/16; Hubrain v. Belgium, no. 57292/16). The ECtHR found that this interference was not justified. To be “in accordance with the law,” an interference must not only have a basis in domestic law, but it must be accessible and sufficiently foreseeable. The regulations governing ongoing retention of data of substitute administrative penalties in this case are not sufficiently foreseeable. Those regulations lay down a clear time-limit (5 years up until February 2013, and 15 years since after an amendment) for keeping record cards for substitute administrative penalties. By contrast, the regulations are ambiguous on the question of whether the electronic data derived from those cards are to be deleted alongside the record cards themselves, or whether they are to be retained for longer or indeed indefinitely. The disagreement between the Bulgarian Ministry of Justice (which considered that the regulations required indefinite retention) and the CPDP (which considered that the regulations required the data to be deleted along with the cards) highlight the ambiguity of the regulations. In considering the Supreme Administrative Court’s decision, the ECtHR noted that the court failed to square the indefinite retention period with the principle of storage limitation in data protection law. Finding that the retention of data was not sufficiently foreseeable and thus interference was not in accordance with the law, the ECtHR found a violation of Article 8(2) of the Convention. The ECtHR rejected the data subject’s claim in respect of loss of earnings because the claim concerning the disclosure of the data and resulting dismissal was declared inadmissible. The ECtHR also rejected the applicant’s claim for non-material damages because there is no evidence of real detriment to the data subject. The ECtHR did, however, award lawyer’s fees in the amount of EUR 2,900 plus tax for lawyer and translation fees.