Agentsia po vpisvaniyata – CJEU Judgment (Bulgaria, 2024)

The data subject is a shareholder of a company in Bulgaria. On 14 January 2021, the company’s constitutive instrument was sent to the Registration Agency (Agentsia po vpisvaniyata), the Bulgarian authority managing the commercial register (the controller in the case at hand). This instrument, which includes the surname, first name, identification number, identity card number, date and place of issue of that card, as well as the data subject’s address and signature, was made available to the public by the Agency as submitted. On 8 July 2021, the data subject requested the controller to erase the personal data relating to her contained in that constitutive instrument. In order to comply with this request, on 26 January 2022 the controller requested the data subject to provide a copy of the instrument in which the personal data of the company members, other than the personal data required by law, were redacted. On 31 January 2022, the data subject brought an action before the Administrative Court of Dobrich (Administrativen sad Dobrich) seeking annulment of the controller’s decision and an order that the controller compensate her for the alleged non-material damage. On 5 May 2022, this court annulled the decision and ordered the controller to pay compensation to data subject in the amount of BGN 500 (approximately €255). The court ruled that, first, the damage consisted in psychological and emotional suffering, i.e. fear of possible abuse, as well as the sense of powerlessness and disappointment that her personal data could not be protected. Second, the damage stemmed also from the controller’s decision, which had led to an infringement of the right to erasure and the unlawful processing of her data contained in the constitutive instrument. The controller appealed this judgement in front of the Supreme Administrative Court (Varhoven administrativen sad), which stayed the proceedings and referred the following questions to the CJEU: # if [https://eur-lex.europa.eu/leg