H.MB EAD – Violation Found (Bulgaria, 2022)

The data subject applied for a vacant position at the company H.M.B. EAD (controller). After signing some paperwork, the data subject and the controller agreed to another meeting in order to finalise the employment contract. On 28 April 2021, before such meeting took place, the controller sent the papers signed by the data subject to the 'National Revenue agency' (NRA). According to Article 62(5) of the Bulgarian Labour code, an employer had to notify the NRA within three days of signing/closing the employement contract. In the end, the data subject did not complete the application procedure. The data subject stated that she had been registered as an unemployed person on 8 February 2021 and had been granted unemployment benefits for three months. However, the benefits suddenly stopped, which is why the data subject checked with the social insurance institution for the cause of this issue. Here, she discovered that the controller had filed the signed papers as an employment contract, which had made her ineligible to receive further unemployment benefits. The data subject filed a complaint at the Bulgarian DPA, stating that the controller unlawfully processed her data by submitting an employment contract without her knowledge. The data subject stated that she did not sign any employment contract and did not provide any personal data to the controller. The controller stated that the allegations of the data subject were false. It stated that on 17 April 2021, the data subject had provided her CV to the controller in order to apply for a vacant job position. The controller did not deny that an employment contract had not formally been signed yet, but stated that the job-offer documents contained all the aspects of an employment contract and could therefore be regarded as such. This was also the reason why the company submitted the documents to the NRA pursuant to Article 62(5) of the Labour code. The signed documents also included a declaration of consent by the data