Court case ВАС - № 6515 – Court Ruling (Bulgaria, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Bulgarian court ruled that a heating company, Toplofikacia Sofia, improperly used customer mortgage documents in a legal case without a valid reason. The court ordered the company to pay compensation to the affected customers. This decision highlights the importance of having a clear legal basis for using personal data in court proceedings.
What happened
Toplofikacia Sofia used customer mortgage deeds in court without a valid legal basis.
Who was affected
Customers of Toplofikacia Sofia whose mortgage deeds were used in court.
What the authority found
The court found that Toplofikacia Sofia lacked a valid legal basis for processing the personal data in the mortgage deeds, violating GDPR requirements.
Why this matters
This case emphasizes the need for companies to ensure they have a proper legal basis before using personal data in legal matters. It serves as a reminder for businesses to review their data handling practices, especially when involving sensitive customer information in court.
GDPR Articles Cited
National Law Articles
The controller was Toplofikacia Sofia EAD, a heating company in Bulgaria. The data subjects were customers of the controller. The controller submitted a copy of the data subjects' mortgage deed as evidence in a separate court procedure before the District Court of Sofia. The controller had obtained a copy of the document in the normal course of business with the data subjects. Bulgarian law required that the controller establish the property rights of its customers before executing a contract to supply heat. The Administrative Court of Sofia found that the controller had processed data on the property and financial situation of the data subjects contained in the mortgage deed without a legal basis under Article 6 GDPR and ordered the controller to pay the data subjects €127.82 Euro (250 BGN) each as compensation for non-material damages. The controller appealed the decision, taking the view that the lawful bases for processing the data subjects' personal data were "data subjects' consent," "neccessary for performance of a contract," and "necessary for compliance with a legal obligation," under Articles 6(1)(a), 6(1)(b), and 6(1)(c) GDPR respectively. The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. First, the Court confirmed that the controller had processed the data subjects' personal data: The mortgage contained the data subjects' personal data because it contained their names as well as financial and property information (all relating to identified natural persons per Article 4(1) GDPR), and the controller processed that data initially by collecting it. The Court clarified that retaining the data and later producing it before a court were further processing that required a legal basis under Article 6. Next, the Court acknowledged that the data subjects did in fact consent to the initial processing (collection) of their personal data, but it stressed that this consent extended only insofar as processing was nec
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case ВАС - № 6515 in BG
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case ВАС - № 6515 - Bulgaria (2022). Retrieved from cookiefines.eu
Last updated: