83 citizens filed a class action lawsuit against the National Revenue Agency (NRA) over the unprecedented leak of personal data, which became first publicly known on July 15 this year (for more information on this topic, please turn to our previous article). The leaked information included a broad spectrum of personal data about Bulgarian and foreign natural and legal persons, such as PINs (personal identification numbers), addresses, emails, telephone numbers, information about income, health status, tax and social security information.
The class action lawsuit is filed by the ILAC - International Legal Advice Center in the Administrative Court – Sofia city, as according to Protection of Personal Data Act (PPDA), when there are any breaches of the General Data Protection Regulation (GDPR) the data subject has the right to effective judicial remedy and to appeal against actions and acts of the controller before the court in accordance with the Administrative Procedure Code of Bulgaria. The proceedings were however terminated on grounds that class action lawsuits are not within the competence of administrative courts and the claim must be heard and decided on by the Sofia City Court. Thus, a dispute about the courts’ competence arose and the case was sent to the Supreme Court of Cassation. After the appointment of a court body, it is expected that it will decide on the courts’ competence on this case.
Under GDPR each person who has suffered tangible or intangible damages as a result of processing that infringes the regulation has the right to receive compensation from the controller or the processor of personal data for the damages sustained. Based on these grounds, the class action lawsuit asks from the court to: 1. To establish the guilty and unlawful conduct of actions of the NRA for a period up to 16.07.2019, from which a determinable group of persons – data subjects who are Bulgarian citizens, whose personal data has become publicly available through the files, which have leaked from the NRA – have sustained non-material damages, namely the public disclosure of their personal data including three names, PINs, etc.; 2. То rule the NRA to pay compensate the damages caused to the collective interest, in the amount of 1000 BGN for each data subject, whose personal data has become publicly available as a result of the breach in the security of the electronic system of the NRA. If the violation of NRA is established and the court rules in favor of the claimants, the court’s decision will have effect against the offender and the claimants, as well as against all persons, claiming to have sustained damages by the personal data breach by the NRA and who have not stated that they wish to file their claims in separate proceedings. But even if some persons have presented their intention to file claims in separate proceedings, the excluded persons may still benefit from the court’s decision which rules in favor of the class action lawsuit.
According to the PPDA, the data subjects cannot bring a case before the court, where there is pending proceedings before the Commission for Personal Data Protection (CPDP) for the same violation or a decision on the same violation has been appealed and there is no court decision in force. In August 2019, the CPDP imposed a fine in the amount of 5.1 million to the NRA, whereby according to the CPDP the sanction is determined after taking into account several factors, namely the type of violation, the volume and scope of personal data available, the number of persons – Bulgarian citizens, which have been affected. The NRA has expectedly appealed against the lawfulness of the act, which imposes the fine, as well as against the amount of the fine.
