- Enforcing jurisdiction
- Bulgaria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case ВАС - № 6515 – Court Ruling (Bulgaria, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Bulgarian heating company was ordered to compensate customers for processing their mortgage data without proper legal grounds. The court ruled that the company did not have a valid reason to use this personal information. This case highlights the need for companies to ensure they have a legal basis for processing personal data.
What happened
The court found that Toplofikacia Sofia EAD processed customers' mortgage data without a legal basis.
Who was affected
Customers of Toplofikacia Sofia EAD whose mortgage data was improperly processed.
What the authority found
The court ruled that the company violated GDPR by not having a valid legal basis for processing the mortgage data.
Why this matters
This ruling serves as a warning to companies about the importance of having a legal basis for processing personal data. Businesses should review their data handling practices to avoid similar violations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller was Toplofikacia Sofia EAD, a heating company in Bulgaria. The data subjects were customers of the controller. The controller submitted a copy of the data subjects' mortgage deed as evidence in a separate court procedure before the District Court of Sofia. The controller had obtained a copy of the document in the normal course of business with the data subjects. Bulgarian law required that the controller establish the property rights of its customers before executing a contract to supply heat. The Administrative Court of Sofia found that the controller had processed data on the property and financial situation of the data subjects contained in the mortgage deed without a legal basis under Article 6 GDPR and ordered the controller to pay the data subjects €127.82 Euro (250 BGN) each as compensation for non-material damages. The controller appealed the decision, taking the view that the lawful bases for processing the data subjects' personal data were "data subjects' consent," "neccessary for performance of a contract," and "necessary for compliance with a legal obligation," under Articles 6(1)(a), 6(1)(b), and 6(1)(c) GDPR respectively. The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. First, the Court confirmed that the controller had processed the data subjects' personal data: The mortgage contained the data subjects' personal data because it contained their names as well as financial and property information (all relating to identified natural persons per Article 4(1) GDPR), and the controller processed that data initially by collecting it. The Court clarified that retaining the data and later producing it before a court were further processing that required a legal basis under Article 6. Next, the Court acknowledged that the data subjects did in fact consent to the initial processing (collection) of their personal data, but it stressed that this consent extended only insofar as processing was nec
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case ВАС - № 6515 in BG
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
29 June 2022
Authority
DPA AdministrativeCourto
About this data
Cite as: Cookie Fines. Court case ВАС - № 6515 - Bulgaria (2022). Retrieved from cookiefines.eu
Last updated: