Dimitrov, Petrov & Co

# 18 The Bulgarian Commission for Personal Data Protection published an opinion on the determination of the figures of “controller” and “processor” in the conduct of clinical trials

Crucial for the pharmaceutical sector opinion of the Bulgarian Commission for Personal Data Protection (CPDP/Commission) on the determination of the figures of “controller” and “processor” in the conduct of clinical trials was published on 10.06.2019 on the website of the Commission.

According to the opinion, when conducting clinical trials, the medical institutions and the sponsor of the clinical trial act in the capacity of joint controllers under the meaning of Art. 26 of the Regulation (EU) 2016/679 (GDPR).

The opinion has been published after CPDP examined a request by a company having the capacity of a “sponsor” under the meaning of § 1, item 8 of the Additional Provision of the Medical Products in the Human Medicine Act (MPHMA), i.e. a company which is responsible for initiating, management and/or financing a clinical trial and is participating in the clinical trials initiated by it. The requesting company states that while conducting clinical trials, the sponsor also has relations with other persons participating in the clinical trials, namely with the principal investigator and the investigators, as well with the members of the investigator’s team – collaborators, monitors and auditors of the trial.

To clearly determine the roles of the parties, CPDP examines the figures of “Controller” and “Processor” in the light of the national and EU legislation regulating clinical trials. Furthermore, CPDP explains that the Regulation (EU) No 536/2014 of the European Parliament and of the Council on Clinical Trials on Medicinal Products for Human Use and the MPHMA exhaustively determines the functions and tasks of all persons participating in a clinical trial. According to the Commission, the data processing activities related to the conduct of clinical trials, could not be carried out “on behalf” of the sponsor of the trial, since such activities cannot be carried out by it, but only by organizations authorized in accordance with the applicable procedures and having the status of a “medical institution”. This is yet another confirmation of the thesis long ago adopted both in theory and practice (including that of CPDP), that not each assignment contract automatically leads to arising of relationship of the type of controller-processor and that in order to adequately determine the roles and responsibilities of the parties with regard to the processing of personal data, the nature of the rights and obligations of the parties in the contractual relationship need to be taken into account.

An additional argument for classification of the parties‘ roles according to CPDP is the Opinion 1/2010 of the Article 29 Data Protection Working Party (now European Data Protection Board) on the concepts of “controller” and “processor” which explicitly states that when conducting clinical trials, the participants are processing personal data in the capacity of joint controllers (p. 30 from the Opinion).

The main consequence of this opinion for the pharmaceutical companies and the medical institutions that conduct clinical trials is that they will need to conclude an agreement between themselves that shall in a transparent manner determine their respective responsibilities for compliance with the obligations in the field of data protection. In particular, they will have to regulate matters related to exercising the rights of the data subject and their respective duties to provide the information referred to in Art. 13 and 14 of GDPR. Furthermore, the data subjects-participants in the clinical trial may exercise their rights in respect of and against each any of the controllers. (Art. 26, Para. 3 of GDPR).

# 17 The Territorial Scope of GDPR

Further to the series of publications regarding the changes introduced by the GDPR, in this publication we will introduce to you the territorial scope of the GDPR.

The territorial scope of the GDPR is a key factor of importance for achieving compliance with the data protection requirements since nowadays many services are delivered globally and online. Especially, companies outside the EU are in the need to determine whether they are directly subject to the strict requirements of the GDPR. To help companies, in the late 2018 the WP29’s successor, the European Data Protection Board (EDPB) published, Guidelines on the territorial scope of the GDPR.

This article aims to summarize and clarify the criteria as well to provide some useful insights and guidelines on the territorial scope of the GDPR.

The territorial scope of the GDPR is determined by its Article 3 as the norm contains three basic criteria.

Establishment in the EU
The first criterion for determining the applicability of the territorial scope of the GDPR is the establishment of controller or processor in the Union (Article 3 (1)).

According to the GDPR, ‘establishment’ implies the effective and real exercise of activity through stable arrangements. The form of the arrangements, for example, whether the activity is being carried out through a branch or a subsidiary, is not relevant.

The CJEU in its practice ruled that the notion of establishment extends to any real and effective activity exercised through stable arrangements. In fact, even the presence of one single employee or agent of the non-EU entity may be enough to constitute a stable arrangement if that employee or agent acts with a sufficient degree of stability.

Circumstances that the non-EU entity does not have a branch or subsidiary in a Member State do not preclude it to be considered as having an establishment there within the meaning of the GDPR. This means that when a company with headquarters in the US has a branch, a sales office or when just performing activities for revenue raising in the EU, it could be considered as to have stable arrangements thus establishment in the EU and the GDPR to be applicable on its activities.

Article 3 draws also the attention that the criterion for establishment in EU should be evaluated on both the controller as well as the processor. The EDPB takes the view that when it comes to the identification of the different obligations triggered by the applicability of the GDPR, the personal data processing activities by each legal subject be it controller or processor should be seen as a separate topic.

For example. where a controller established in the EU mandates a processor located outside the EU, the non-EU processor will not be considered as having an establishment in the EU just because the controller in an EU entity. In such case, the GDPR will not directly be applicable to the non-EU processor. Only the EU-controller will be required to comply with all the GDPR requirements applicable to controllers (the ‘GDPR controller obligations’). One of those obligations is, namely, to ensure by contract or other legal act that also the non-EU processor will process the data in accordance with the GDPR.

On the contrary, a non-EU controller cannot be considered as having an establishment in the EU just because it uses a processor established in the EU. In the latter case, the GDPR would be applicable only to the EU-processor, and, only it will be required to comply with the GDPR requirements applicable to processors (the ‘GDPR processor obligations). These are, for example, for the EU-processor to implement appropriate technical and organizational measures in accordance with the GDPR, to notify the controller without undue delay after becoming aware of a personal data breach, or to designate a data protection officer.

Targeting persons EU
The second criterion is the so-called ‘targeting’ of persons in the EU (Article 3 (2)). The GDPR defines the targeting criterion in the ‘offering of goods or services irrespective of whether a payment is required to data subjects in the EU’, and in the ‘monitoring of their behavior as far as their behavior takes place within the EU’.

This largely focuses on the question whether the activities of an entity are addressed/targeted at users in the EU which is to be determined on a case-by-case basis.

The location of the subject data in the territory of the EU is a determining factor for the application of the targeting criterion. The EDPB considers that the nationality or legal status of a data subject cannot limit or restrict the territorial scope of the GDPR. Therefore, also activities addressed at citizens of third-countries who are in the EU may trigger the application of the targeting criterion and lead to applicability of the GDPR on these activities.

In order for companies to determine whether their activities are to be considered as offering of goods or services to data subjects in the EU, the latter should assess all for their business model relevant circumstances such as their intention to offer goods or services in the EU, whether their website, support or maintenance services are being offered in a local language and accept local currency, whether they have appointed a local point of contact for sales and support services etc.

To trigger the application of the second targeting criterion mentioned by the GDPR, namely, the ‚monitoring of behavior‘, the monitoring activity must first relate to a data subject in the EU and the monitored behavior must take place within the territory of the EU. The GDPR and the EDPB mention as few examples for monitoring activities the behavioral advertisement, geo-localization activities, online tracking through the use of cookies or other tracking techniques, personalized diet and health analytics services online, CCTV, market surveys and other behavioral studies based on individual profiles, monitoring or regular reporting on an individual’s health status etc.

It is important to note that the processing of personal data of persons located outside the territory of the EU, be it EU citizens or not, does not trigger the application of the GDPR, as long as the processing is not related to a specific offer directed at individuals in the EU or to a monitoring of their behavior in the EU.

Application of Member State Law by virtue of public international law
The provision of Article 3(3) is expanded upon in Recital 25 which states that where Member State law applies by virtue of public international law, the GDPR should also apply to a controller not established in the EU.

This means GDPR could also apply to personal data processing carried out by EU Member States’ embassies and consulates, or in EU ships in international waters. The fact that a data processing activity is being carried out on an EU-registered cruise ship means that by virtue of public international law the GDPR shall be applicable.

Controllers or processors not established in the Union must appoint a local representative
Finally, please be always advised that a controller or processor not established in the EU but subject to the GDPR is, obliged to designate a representative in the EU in accordance with Article 27 and failing to designate such a representative would consequently be in breach of the Regulation by the respective controller or processor.

The GDPR and EDPB provide some further guidance on the designation process, establishment obligations and responsibilities of the representative in the EU. For example, it is important to know that the representative:
• can be natural or legal person established in the Union;
• should be explicitly designated by a written mandate such as written contract with the controller or the processor to act on its behalf with regard to its obligations under the GDPR such a service contract;
• in general, cannot be at the same time data protection officer (DPO) of the company;

Article 27(2) foresees some exceptions from the mandatory designation of a representative in the Union such as when:
• the processing is occasional, does not include, on a large scale, processing of special categories of data or processing of personal data relating to criminal convictions and offences; or
• the processing is carried out by a public authority or body.
Article 27(3) foresees that the representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are.

The EDPB further recommends, that the representative must remain easily accessible for any data subjects in any Member State where the services or goods are being offered or where the behavior is being monitored.

Please be advised that the representative in the Union acts on behalf of the controller or processor it represents with regards to the controller or processor’s obligations under the GDPR. This implies notably the obligations relating to the exercise of data subject rights, and in this regard the identity and contact details of the representative must be included in all information documents of the controller in accordance with the requirements of Article 13 and 14 such as their privacy notices.

The representative should also perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities regarding any action taken to ensure compliance with this Regulation.

The Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) of the European Data Protection Board can be found here.

# 15 DOs and DON’Ts under the new Bulgarian data protection law

As of today, February 26, the long-awaited amendments to the Personal Data Protection Act (the “Act/PDPA”) aimed at harmonizing the Bulgarian legislation with the General Data Protection Regulation (GDPR) are already a fact. In addition, the Act brings about certain specific national regulations.

Below you will find a short list of some of the most important requirements introduced by the new Act:

DОs

Adopt explicit internal rules in case you carry out any of the following activities or you have implemented any of the following processes within your organisation:
– You conduct video surveillance;
– You have restricted the use of the company’s devices, systems or resources (for example, if you have restricted your employees’ access to certain websites);
– You have implemented a system for reporting violations (the so-called “whistleblowing” systems);
– You have implemented systems controlling the access, the working hours or the work discipline (card check-in systems, GPS systems for tracking company’s cars and other company’s technical devices);
Inform your employees about the adopted internal rules and provide them with access to these documents;
Store the personal data collected within recruitment procedures for no more than 6 months. Request the applicant’s consent to store his/her data for a longer period;
Appoint a Data Protection Officer (DPO) in case you fall within the definition of a “public authority” in accordance with the Act – a state or local authority, as well as a structure, the main activity of which is related to expenditure of public funds;
Provide the names, PIN/PNF and contact details of your DPO (if designated) to the Commission for Personal Data Protection (CPDP);
Whenever minors’ personal data (under the age of 14) is processed on the basis of consent, require consent from parent exercising parent’s rights/from guardian. This requirement applies not only to the provision of information society services, but to any form of processing based on consent as well;
In cases where personal data of deceased persons is processed, such processing shall only be carried out in case there is a legal ground therefor and by taking appropriate measures so that such processing shall not adversely affect the rights or freedoms of others or any public interest;
When processing personal data for the purposes of journalistic, academic, artistic and or literary expression, always try to strike a balance between freedom of expression, right to information and privacy in compliance with the criteria set out in the PDPA.

DON’Ts

Do not copy identification documents (ID card, passport, driver’s license) or residence permit (unless you have ensured a legal ground provided for by law);
Do not allow free public access to information containing PIN/PNF, unless otherwise provided by law (for example: publication of lists containing personal data);
Do not use PIN as passwords as the Act requires the adoption of appropriate technical and organizational measures to prevent the use of PIN/PNF as the only means of user identification when providing remote access to electronic services (e.g. as a password for access to medical test results).

Tailor your practices to the new requirements, bearing in mind that our list is not an exhaustive one and is intended only to familiarize you with the general structure of the amendments adopted.

Keep an eye on our follow up publications where the most important changes will be analyzed in more detail and we will continue to keep you up-to-date in the field of personal data protection!

# 14 The Bulgarian Commission for Personal Data Protection adopted list of the processing activities where data protection impact assessment under GDPR is mandatory

Further to publication #12 Data Protection Impact Assessment from our Blog we inform You that the Commission for Personal Data Protection published a list of the types of processing operations for which data protection impact assessment (DPIA) is required. The list was published on 13.02.2019 on the Commission’s website.

Pursuant to the above-mentioned list data controllers whose main or single establishment is on the territory of the Republic of Bulgaria are required to conduct compulsory DPIA in each of the following cases:
• Large scale processing of biometric data for the purposes of the unique identification of a natural person, which is not occasional;
• Processing of genetic data for profiling purposes which produces legal effects for the data subject or similarly significantly affects them;
• Processing of location data for profiling purposes which produces legal effects for the data subject or similarly significantly affects them;
• Processing operations for which the provision of information to the data subject pursuant to Art. 14 of GDPR is impossible or would involve disproportionate effort or is likely to render impossible or seriously impair the achievement of the objectives of that processing, when this is related to large scale processing;
• Personal data processing by controller whose main place of establishment is outside the EU when its designated representative for the EU is located on the territory of the Republic of Bulgaria;
• Regular and systematic processing for which the provision of information pursuant to Art. 19 of GDPR by the controller to the data subject is impossible or involves disproportionate efforts;
• Processing of personal data of children in relation to the offer of information society services directly to a child;
• Migration of data from existing to new technologies when this is related to large scale data processing.

The current list – adopted on the basis of Art. 35 Para 4 of GDPR – is non-exhaustive and can be updated, if necessary. We will inform You accordingly for any such updates.

# 12 Data protection impact assessment – a key part of GDPR compliance

Further to the series of publications regarding the changes introduced by the GDPR, in this publication we will introduce you to one of the new concepts set out in the GDPR, namely the Data protection impact assessment (DPIA).

What is DPIA?

Data controllers are responsible for introducing appropriate safeguards to ensure compliance with the GDPR taking into account “the risks of various likelihood and severity to the rights and freedoms of natural persons”. In this sense, their role is not limited solely to the control and definition of the purposes and means of personal data processing, but also includes their obligation to manage the risks that could arise as a result of that activity.

The main objective of the DPIA is to clarify, to describe all processing processes, to assess their necessity and proportionality, and to contribute to the adequate and appropriate management of risks to the rights and freedoms of natural persons arising from the processing of their personal data.

What is DPIA expressed in and what does it contain?

Article 35, Para.7 of the GDPR sets out the minimum features of a DPIA, namely:

a systematic description of the envisaged processing operations and the purposes of the processing;
an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
an assessment of the risks to the rights and freedoms of data subjects;
the measures envisaged to address the risks and demonstrate compliance with thе Regulation.

The assessment of the risks to the rights and freedoms of the processing is one of the main components of the DPIA. Some of the risk assessment guidelines and principles set out in the GDPR partially overlap already existing internationally recognised risk management standards, such as ISO 31000:2009. Examples in this regard are:

establishing the context: “taking into account the nature, scope, context and purposes of the processing and the sources of the risk”;
assessing the risks: “assess the particular likelihood and severity of the high risk”;
treating the risks: “mitigating that risk” and “ensuring the protection of personal data”, and “demonstrating compliance with this Regulation”.

DPIA – when it should be carried out?

It is important to note that the carrying out of a DPIA is only mandatory where a processing is “likely to result in a high risk to the rights and freedoms of natural persons”. In this sense, considered to be the most dangerous is the processing of data that is of a very personal nature by technical means without human intervention (e.g. algorithms / software) including:

Systematic and detailed assessment of personal aspects related to health, workplace performance, personal preferences, location, economic status with respect to individuals, which is based on automatic processing, including profiling, for creating or using personal profiles;
Large-scale processing of special categories of data (e.g. data on racial or ethnic origin, political views, sex life, etc.) or personal data on convictions and offenses (Article 9, Para. 1 and Article 10 GDPR);
A systematic monitoring of a publicly accessible area on a large scale; etc.

In any case, the DPIA should be carried out before the processing. (Article 35, Para.1 and 10, Rec. 90 and 93). The Working Party under Art. 29 recommends that evaluation should be carried out, even when there is doubt as to the need for such assessment, as “DPIA is a useful tool to help controllers comply with data protection law” [1] and with the principle of accountability (for more information see publication #8 ACCOUNTABILITY AS A NEW PRINCIPLE OF GDPR).

Which data processing activities are considered high risk?

In the Guidelines of the Working Party under Art. 29 there are nine criteria in which the controller can identify operations that may result in a high risk to the rights and freedoms of the natural persons:

1) Existence of assessment or scoring, including profiling and prediction – an example in this respect are financial institutions reporting to their clients in connection with granting credits in databases for fighting against money laundering or terrorist financing; genetic testing for prediction of disease risks; companies that create behavioural or marketing profiles based on a website; etc.

2) Existence of automated decision making with legal or similar significant effect – automated decision making is the ability to make decisions by technological means without any human involvement. An example is when the decision on credit approval is made by a person on the basis of a profile designed entirely by automated means, or when the decision on the approval of the loan is made by means of an algorithm and the person is automatically notified of the decision without first being made a meaningful assessment by a human.

3) Existence of processing used for different types of surveillance or control of data subjects – including monitoring through which personal data is being processed where data subjects do not realize who collects their data and how it will be used, e.g. video surveillance in a public area;

4) Existence of processing of special categories of data – public hospitals that store patients’ medical records should carry out a DPIA because they operate with sensitive data, notably the health of natural persons;

5) Existence of large-scale processing of personal data – determining the scale is a separate process that involves careful consideration of factors such as: the number of data subjects involved, the volume of data or the scope of the different types of data, the duration or continuity, and the geographical scope of the processing activity;

6) Datasets that have been matched or combined, resulting from two or more processing operations performed for different purposes and / or by different controllers in a way that goes beyond the reasonable expectations of the subject – In such cases, the nature of the contractual arrangements, and the balance between the subject and the data controller in particular, should be examined, for example, to what extent the data subject is free to terminate the contract and seek alternative service providers;

7) Processing of data concerning vulnerable data subjects including any case where imbalance between the position of the data subject and the controller can be identified – examples in this respect are children – persons subject to treatment, mentally ill persons, asylum seekers, patients, elderly people, etc.

8) Existence of innovative use or applying technological or organisational solutions – an excellent example in this regard is the use of fingerprints and face recognition to improve access control;

9) Preventing data subjects from exercising the right to use a service or contract – here again is the example with a bank screens a client aganst a credit reference database, i.e. in this case, the processing of the subject’s personal data may lead to them being deprived of the possibility of taking a loan.

As a rule of thumb, a processing operation meeting less than two of the aforementioned criteria may not require the carrying out of a DPIA due to the lower level of risk. Conversely, the more criteria the processing operations meet, the higher the likelihood of high risk with regard to the rights and freedoms of natural persons.

In addition, GDPR imputes an obligation to the supervisory authority for establishment and publishing a list of the processing operations that require a DPIA. Moreover, the supervisory authority could establish and publish a list with the processing operations, for which a DPIA is not mandatory. Currently, the Commission for Personal Data Protection (CPDP) has not made such lists public yet.

What follows after the carrying out of DPIA?

DPIA does not constitute of a single action, but of an entire process of achieving and demonstrating compliance.

However, once carried out, the DPIA could be applied for assessment of numerous processing operations similar to the risks presented, taking into account the nature, scope, context and purposes in light of the concrete case. When the processing operation involves joint controllers, they need to define their respective obligations precisely and clearly. Their DPIA should set out which party is responsible for the various measures designed to treat risks and to protect the rights of the data subjects.

If the data controller considers a DPIA not to be mandatory, he is obliged to make a detailed statement of the reasons for not taking action.

Carrying out the DPIA may be outsourced to an outside person.

If the processing is wholly or partly performed by a data processor, the processor should assist the controller in carrying out the DPIA and provide any necessary information. The roles and responsibilities of the processors must be defined precisely in a separate contract/agreement. Such obligations are usually imposed to the processor in the data processing agreement between the controller and the processor.

The controller will also have to consult the supervisory authority whenever Member – state Law requires such actions.

In the light of the above, it remains intriguing what measures would be provided in the new amendments of the Personal Data Protection Act.

In conclusion, it should be emphasized on the fact that carrying out a DPIA is a key part of complying with GDPR in cases of high risk processing. This means that data controllers should be able to determine whether a DPIA has to be carried-out or not. Of course, the internal data controller policy could extend the list of data processing activities for a DPIA will be carried-out even beyond the requirements of the GDPR. Such an approach shall absolutely result in building greater trust and confidence of data subjects in the controller and in providing for additional safeguards for the lawful and adequate processing of personal data within the company.

[1] Data Protection Working Party under Art. 29: Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to pose a high risk” for the purposes of Regulation 2016/679 (WP 248 rev. 01), available here.

# 11 The Council of Europe updated the only international legally binding instrument for data protection – Convention No. 108

On the 18th of May 2018, in Helsingør, the Council of Europe adopted an Amendment Protocol of Convention № 108 from 28.01.1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data (“The Convention”).

About the Convention

As of now, the Convention is the only globally relevant international agreement in the field of data protection. It has been created in response to the ongoing challenges to the privacy rights, stemming from the use of new information and communication technologies. With the complete revision of the Convention, the Council of Europe seeks to update it, expand its scope and strengthen the mechanisms it provides, in order to guarantee its effective application.

What are the novelties introduced in the Convention?

The changes to the Convention generally aim to facilitate the trans-border exchange of data while further developing the foundational mechanisms for protection of personal data laid down in the Convention in accordance to the legislative changes on European level. The Convention encompasses data processing in both the public and private sectors, hence, the changes seek to improve the level of personal data protection and its current scope. The discussions and the work on the amendment started back in 2012 and ran in parallel with the rest of the legislative changes to the personal data protection framework within the EU, including with the famous General Data Protection Regulation (GDPR).

The Secretary General of the Council of Europe Thorbjørn Jagland points out that the modernization of the Convention is a reflection of the frequent violations of data protection law as for the main focus in its implementation will be preventing of such in the future.

Numerous novelties in the Convention are in accordance with the solutions provided by the GDPR. Some of the main novelties include:

The categories of sensitive data are expanded – additionally to the current personal data related to: race, political views, religious or other beliefs, health conditions, ethnicity, crimes, criminal proceedings and sentences; now genetic and biometric data, as well as syndicate membership and data related to ethnicity have also been included to the category;
Some of the data subject rights have been expanded, including:
– The right not be a subject of automated decision-making, when the decision has a significant impact on the subject, without considering their viewpoint;
– The right to be informed about the data processing;
– The right of the subject to be informed about the reasoning for data processing, particularly in cases when algorithms are used for the automated decision-making and profiling;
– The right to object against the processing of personal data, related to the subject unless in cases where the legitimate interest of the controller is prevailing;
Additional obligations to the personal data controllers and processors have been introduced:
– The measures undertaken for data protection have to be connected with their obligation to be able to prove the lawfulness of the data processing (the so-called “accountability” principle);
– The principles of data protection shall be applied at all stages of processing, including the designing stage (“privacy by design” and “privacy by default”);
– The suitable measures that have to be undertaken include: training of personnel, establishing suitable notification procedures (establishing data retention periods and specific deadlines for their deletion from the systems); establishing specific contract clauses for delegated processing; establishing of internal procedures providing the possibility to review and to justify compliance, etc.
– The powers of the Authority elected by the parties of the Convention have been strengthened in order to guarantee the application of the provisions of the Convention. According to the Explanatory Protocol to the Convention, the Authority can either be sole (a commissioner) or collegiate body. Most importantly the Authority has to possess effective regulatory powers and functions and to be independent;
– The parties of the Convention may introduce other specific authorities whose activity covers only a very restricted sector (According to the Explanatory Protocol the electronic communications sector, the healthcare sector, the public sector and others);
– The Authority has to be empowered to initiate or participate in court proceedings related to all data protection violations. This is linked to the powers to conduct an investigation and detection of infringements;
– An obligatory notification about data protection breach has also been introduced;
The measures for proportional data processing and application of the principle of data minimization have been strengthened;
Amendment of the current terminology – the term “automated data file” has been repealed and there is one new participant to the data processing, called with the term “receiver” (1) , etc.;
One of the most important additions to the Convention is the enhanced role of the Convention Committee, which has advisory, but also evaluation and supervisor capacity. It will determine whether and to what extent a Member State or an international organization has fulfilled the requirements set by the Convention. The Committee has the right to evaluate the compliance of the internal law of a Convention party and to determine the effectiveness of the undertaken measures.

It is important to note that all countries as well as international organizations, including the European Union, can accede to the Convention. This turns the Convention into a key tool for harmonizing various data protection legal regimes, by ensuring high degree of protection on international level.

The modernization of the Convention is a crucial step towards the promotion of global data protection standards. The renewed Convention seeks to stimulate the inclusion of as many countries as possible aiming to encourage the international business and its development, now on the basis of more secure and universally applicable rules regarding personal data and its efficient protection.

You can find more information on the official website of the Council of Europe here.

(1) Art. 3, “e” – “recipient” means a natural or legal person, public authority, service, agency or any other body to whom data are disclosed or made available; Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108), URL.

# 10 The Act for Amendment and Supplement to the Personal Data Protection Act, synchronized with GDPR, is officially submitted before the National Assembly

On 18th of July the Bill for Amendment and Supplement of the Personal Data Protection Act was submitted before the National Assembly (the New Bill). The New Bill aims to introduce measures to implement EU’s General Data Protection Regulation (the Regulation/GDPR) and transpose Directive 2016/680 on the protection of personal data in the police sector (the changes proposed in this section – Chapter 8a of the New Bill – will be the subject of a follow-up analysis on our blog).

As expected, some rules from the initial bill (the Old Bill) – subject to public consultation since 30.04.2018 – have been revised as a result of the consultation(1).

At first glance and without claiming to be exhaustive, we underline here some of the amendments made in the New Bill:

1. The minimum thresholds for fines and pecuniary sanctions have been removed since such were not provided in the Regulation. Fines/ sanctions will be imposed according to the criteria set out in the Regulation;
2. The envisaged fine for other violations remains up to BGN 5 000 where the minimum threshold of BGN 1 000 is abolished;
3. The New Bill provides safeguards in order to balance the protected secrecy (e.g. the lawyer’s secret) with the investigating powers of the Commission for the Protection of Personal Data (CPDP), insofar such secrecy provides an option to serve the controllers/ processors as grounds for refusal or access to it by CPDP in case of an inspection;
4. The CPDP will maintain a non-public internal register of data breaches and the measures undertaken in accordance with the exercise of its remedial powers. However, new public ones are being introduced:
– Register of controllers and personal data processors who have appointed Data protection officers (DPO);
-The proposal to maintain a DPO register is removed due to concerns of an attempt to introduce a disguised registration regime for this position, which is not provided in the Regulation;Register of the accredited certification bodies;
-Conduct codes register;
5. The provisions empowering the CPDP to conduct trainings of DPOs were also removed;
6. The personal data retention period of all job candidates/applicants cannot be more than 6 months (in the Old Bill the term was 3 years) after the end of the procedure of recruitment. This restriction also applies to documents that certify the physical and mental health of the applicant, the necessary qualifications and experience for the position held. Other provisions on the protection of personal data in the context of the employment relationship are also specified (e.g. the disputed permission to request explicit consent from employees to process their personal data, which is not required by the employer or a legal act is also removed);
7. The requirement for controllers/ processors to appoint a DPO if they process the personal data of more than 10,000 individuals has also been removed since this requirement, as set out in the Old Bill, has raised serious objections in the public consultation procedure (mainly due to the uncertainties of how it would be applied in practice);
8. Structures, whose main activity is related to the spending of public funds, will be considered as a public body/ structure. This will affect their duty to appoint a DPO;
9. The New Bill also provides new provisions regarding the processing of personal data for the purposes of archiving in the public interest, scientific and historical research, statistical purposes and journalistic purposes.

The full text of the New Bill could be found in Bulgarian here.

As your trusted partner we will continue to keep you updated about the New Bill legislation process as well as all the new developments in the personal data protection legislation on a national and European level.

(1) See in this sense also the latest newsletter of CPDP from July 2018, URL

# 6 Administrative Fines under the GDPR

Following our previous publications regarding the GDPR, we shall now look into the most sensitive GDPR-related topic, namely fines and penalties.

We shall discuss the limits for these administrative fines, the criteria applicable to determining the amount thereof, as well as the specificities in work when determining fine amounts in case of undertakings and how group corporate structures shall be affected by the specificities in question.

The Regulation provides for two limits of administrative fines depending on the type of infringement:

Infringements of any of the obligations of the controller/processor (stipulated in Article 8, 11, 25-39, 42 and 43 of the GDPR) are subject to administrative fines up to 10 000 000 EUR, or up to 20 % of the total worldwide annual turnover of the preceding year of an undertaking.
Infringements of the principles of processing inherent in the Regulation, the data subjects’ rights, the transfers of personal data to a recipient in a third country, any obligations pursuant to Member State law and pertinent to special processing situations, as well as non-compliance with an order or a temporary definitive limitation by the supervisory authority are subject to administrative fines up to 20 000 000 EUR, or up to 4 % of the total worldwide annual turnover of the preceding financial year of an undertaking.

The aforementioned amounts are the upper limits of administrative penalties to be imposed. Depending on the specific infringement and the ratio between due care and care actually exercised, the amounts of administrative fines may vary greatly. Different circumstances weigh in when assessing amounts. For instance, in case of infringement of several provisions of the Regulation for the same or linked processing operations, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. In case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.

This raises the question of the criteria for setting the amounts of fines. The Regulation allows for a number of interpretations, but the Article 29 Working Party considers that assessment must depend on the degree of interference and remedy needed for any wrongful conduct or on whether any such interference or remedy is dissuasive or punitive in nature.

So far as the general rules and conditions for imposing administrative fines are concerned, those are detailed in Article 83 of the Regulation. A key element is the requirement to impose effective and proportionate fines. Such fines may be settled based on a number of circumstances such as:

The nature and duration of infringement;
The purpose of the processing concerned as well as data categories affected thereby. Certain special data categories, such as the ones revealing racial or ethnic origin, political opinions and religion are subject to higher protection[1];
The circumstances surrounding the infringement, namely if it is of intentional or negligent character;
The degree of responsibility of the controller/processor when establishing the infringement and upon termination thereof. Notification to the supervisory body and cooperation with the supervisory body in order to mitigate the infringement constitute mitigating factors;
Any other mitigating or aggravating factors also matter, such as previous infringements, financial benefits from the infringement, etc.

The amounts of fines imposed to undertakings may be significant. It is, therefore, reasonable to specify what is meant by “undertaking” in the Regulation. Here the legislator refers to Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU).

Although not explicitly defined therein, the term is given a broader interpretation in the case law of the Court of Justice of the EU, and according to it, for the purposes of Articles 101 and 102, the term “undertaking” is to be understood as an economic unit that may consist of a parent unit and any subsidiaries thereof. Any structures where one company exerts control over another company, whereby both companies are economically and organizationally related, shall constitute one undertaking. Such an interpretation of “undertaking” is likely to result in significant increase in the amounts of fines based on the total worldwide annual turnover of the entire corporate group, not the turnover of the specific business entity to have committed the infringement.

In conclusion, we would like to specify that the amounts of administrative fines discussed above and stipulated in the Regulation, are the upper limits of fines and sanctions that may be imposed in case of graver infringements. The Regulation reads that any case of infringement has to be subjected to extensive evaluation with due consideration of any mitigating or aggravating factors.[2] We would like to reiterate that due to the broad interpretation of the term “undertaking”, the annual turnover of the entire group of companies may be considered when determining the amount of the fine, thus significantly increasing thereof. That is why compliance with the requirements of the Regulation is of paramount importance.

THE TEAM OF DIMITROV, PETROV & CO.

[1] Articles 9 and 10 of the Regulation provide definitions of these special categories.

[2] Guidelines of the Article 29 Working Party on the application and setting of administrative fines for the purposes of the Regulation 2016/679.

# 5 The Transparency Principle under the GDPR

Following our previous publications regarding the key points introduced by the GDPR, now we will focus on one of the new principles of data protection – transparency.

Transparency is a long-established feature of EU law which is all about engendering trust in the processes which affect citizens by enabling them to understand and, if necessary, to challenge those processes[i]. Transparency is intrinsically linked to fairness and the new principle of accountability under the GDPR. The principles of fair and transparent processing require that the data subject should be informed about the existence of the processing operation and its purposes.

Transparency allows data subjects to keep data controllers and processors accountable and to exercise control over their personal data. Transparency requirements apply regardless of the legal ground for processing and throughout the entire life cycle of processing. Transparency as a principle applies to the following three stages of the cycle of processing:

1) Before the processing – when providing information to data subjects in relation to the collection of their data and how these data will be processed;

2) Throughout the whole processing period – in the manners in which data controllers communicate with data subjects in relation to their rights under the GDPR;

3) In specific cases during the processing – e.g. in case of data breaches or substantial changes to the processing.

What is the meaning of transparency? The principle of transparency in general requires that any information and communication relating to the processing of personal data should be easily accessible and intelligible, and clear and plain language should be used. That principle concerns especially information on the controller’s identity and the purposes of processing that is provided to data subjects, as well as further information ensuring fair and transparent processing in respect of data subjects and their right to obtain confirmation of their personal data processing.

Natural persons should be made aware of the risks, rules, safeguards and rights in relation to the processing of personal data, and how to exercise their rights in relation to such processing.

Article 12 of the GDPR provides the requirements to the information provided to data subject in relation to the processing:

it must be concise, transparent, intelligible and easily accessible;
clear and plain language must be used;
the requirement for clear and plain language is of particular importance when providing information to children – children merit special protection as they may be less aware of the risks and their rights in relation to the processing of personal data, so the information addressed to a child must be in such a clear and plain language that the child could easily understand it;
It must be provided in writing or by other means, including where appropriate, by electronic means;
Where requested by the data subject, the information may be provided orally (including by automated means like audio recording) – GDPR specifically requires that information may be provided orally on request provided that the identity of the data subject is proven by other means. This precondition applies only in relation to information provided under Art. 15 – 22 and Art. 34 of the GDPR. General information under Art. 13 and Art. 14 of the GDPR may be provided without the controller requiring the data subject’s identity to be proven[ii];
It must be provided free of charge – controllers cannot charge data subjects for the provision of information. Exception may exist where requests from a data subject are manifestly unfounded or excessive (for example repetitive) – in these cases the controller can either charge a reasonable fee or refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

The categories of information that must be provided are listed in Art. 13 and Art. 14 of the GDPR – these are basically details of the data controller, purposes, legal basis, processing time, information on the rights of the data subject, information on whether the provision of personal data is a legal or contractual requirement, and the consequences of a failure to provide data. A new requirement introduced by the GDPR is to provide information on the legal basis for the processing purposes – controllers should be able to relate each specific processing purpose to a specific legal basis. This actually means that controllers should be aware of the reasons for the processing of personal data and can properly identify the legal basis which is applicable to a particular purpose.

Besides the content, the form and manner in which information under Art. 13 and 14 of the GDPR should be provided are also important. The information in relation to the processing of personal data should be provided to the data subject at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case, but not later than 1 month. With a view to these requirements, controllers should develop mechanisms to inform data subjects within the specified time limit whenever they collect and store information that is not received from the data subjects themselves, but is obtained from the Internet, a public register, etc.

Information about the processing should be provided separately from any other information – in practice, separate documents should be prepared (declarations, notices, privacy policies, and etc.). The Art. 29 Working Party, an EU data protection advisory body, advises on using layered privacy statements and push/pull notices^[iii]. Information which must be provided to data subjects can also be provided in combination to standardized icons allowing the controller to give a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.

In conclusion, we should summarize that the principle of transparency requires providing information to data subjects with regard to every personal data processing, which guarantees their right to be aware of the process and challenge it if needed. Exceptions to this requirement are very limited – where the data subject already has the information or where providing the information proves impossible or would involve a disproportionate effort.

Duly documenting how the principle of transparency is guaranteed becomes even more important in the context of the new principle of accountability according to which controllers carry the burden and must at all times be able to demonstrate compliance with the GDPR requirements. Therefore, it is advisable for all companies to develop mechanisms to ensure the compliance with the transparency requirement – the development of appropriate tools (privacy policies, communications, declarations) as well as procedures for informing the subjects (e.g. in case of breaches of the data security).

TEAM OF DIMITROV, PETROV & CO.

[i] Guidelines on transparency under Regulation 679/2016 of Article 29 Data protection working party (project), p. 5

[ii] Guidelines on transparency under Regulation 679/2016 of Article 29 Data protection working party (project), p. 11

[iii] Guidelines on transparency under Regulation 679/2016 of Article 29 Data protection working party (project), p. 17-18.