[size=75:1ajzyfqo]Sofia echo 15 February 2010

Abuse of personal data in Bulgaria continues, official says

Companies are continuing to collect more personal data than absolutely necessary, Bulgarian Commission for Personal Data Protection (CPDP) chairperson Veneta Shopova said.

The practice of scanning or photo-copying ID documents was continuing, despite this being against Bulgarian law, Shopava said in an interview with Bulgarian news agency BTA.

Among the companies that abused personal data were mobile operators. Almost every month the commission received tip-offs from people whose personal data had been abused, Shopova said.

The most frequent complaint was about the sale of mobile phone packages with a SIM card for which the client had never signed, but for which was billed. Such cases were referred to law enforcement authorities, Shopova said.

"
There have been several cases in which, in order to keep things quiet and avoid subsequent action, operators would write a letter, waiving the due sum. In these cases, it has been clear that the abused personal data did not come from an outsider, but from employees at the company,"
Shopova was quoted by BTA as saying.

The practice of collecting more personal data than absolutely necessary continued as well, Shopova said. As an example she pointed out the electronic card system for public transport. The system used one single form where health-related data had to filled in, regardless of whether or not the applicant wanted a reduced price card for physically handicapped, she said.

Photo-copying or scanning of ID documents still continued, albeit less than before, Shopova said.

"
We have had a long battle over this, but it still continues. And the argument as to why companies do it is illogical: they treat each customer as possibly insolvent or possibly criminal, so they want to have as much data as possible, just in case the client one day stops paying,"
Shopova said.

For a service contract, the only data that is necessary is the full name, address and EGN (Bulgarian social security number) or the number of the client's ID documents, she said.

Shopova said there had been several cases of abuse of personal data by Bulgarian media.

"
In one case, the medical records of [television host] Slavi Trifonov were published, now we have a case in which a prosecutor's documents, which contained a lot of personal data, have been published,"
she said.

There had been one case in which someone's religious beliefs had been published. "
She filed a complaint, but we did not find that to be abuse of personal data,"
Shopova said.

[size=75:23tpz65a]DLA Piper 12 February 2010 [url=http:
//www.
dlapiper.
com/deadline-near-data-controllers-in-bulgaria-must-update-registrations/:23tpz65a]LINK[/url:23tpz65a]

Deadline near: data controllers in Bulgaria must update registrations

Registration requirements for Bulgarian data controllers are about to change.

Under Bulgaria’s Personal Data Protection Act (PDPA), data controllers must register with the Personal Data Protection Commission (the Commission) before initiating any personal data processing. By February 15, 2010, all such data controllers who have filed an application for registration with the Personal Data Protection Commission in hard copy should check the status of their application in the electronic register of data controllers with the Data Protection Commission.

If necessary, these data controllers must update the information contained therein.

Failure to provide accurate updates to information may result in fines and sanctions.

Registration

Registration by data controllers with the Commission includes general registration as a data controller and registration of the personal data registers controlled by the relevant data controller. Any changes in the registered data and the registers requires prior notification of the Commission.

Registration update

Currently, the Commission is in the process of implementing an electronic register of data controllers. All applications by data controllers for registration, filed in hard copy, are automatically being transferred to an electronic register of personal data controllers (called eRPDC). As part of this process and because of changes in the PDPA, the application form has been amended. Part of the data being requested has been changed. Additional data not on the original application is also being requested. Thus, data controllers should check the present status of their initial application in the eRPDC to determine whether they should update their existing registration. The names of those data controllers whose registration with the Commission should be updated by February 15, 2010 are set out in a specific list on the Commission’s website.

Pursuant to the instructions provided on the website, all data controllers that have filed applications for registration in hard copy should:

* Visit the public part of the eRPDC on the Commission’s website to check whether they are included on the list of data controllers subject to registration update.

* If included in the list, a data controller should file an application to update the information set out in the initial registration. The application can be filed on line with an electronic signature or submitted by an authorized representative to the Commission. Currently, no administrative fees are envisaged by the Commission for the registration update.

* If applicable, file an application for registration exemption.


Exemption from registration

Pursuant to the Regulation for the Activity of the Commission (promulgated State Gazette No.11/10.02.2009, as amended from time to time) which is in force as of February 10, 009, the Commission could relieve a data controller from the obligation for registration if at least one of the following conditions is met:

* The data controller has been processing personal data with the consent of the data subject for a period of up to six months.

* The data is processed in public registers on the basis of laws regulating the access and safety measures with respect to the data.

* The data controller is processing personal data for labor or membership purposes and such data refers to not more than 15 data subjects.


In the above cases, the data controller may apply for and obtain a Commission's decision of exemption of registration. However, that decision would not relieve data controllers from the Commission's control under the PDPA.

Sanctions

Pursuant to article 18, section 3 of the PDPA, all data controllers have the obligation to notify the Commission of any changes in the registered data or registers before their implementation. Administrative sanctions in the form of fines for violations of registration obligations under the PDPA range from BGN 1,000 to BGN 10,000 (€ 500 to € 5,000;
about US$ 680 to US$ 6,800).

This might be of interest to follow on from Ashley's post [url=http:
//www.
out-law.
com/page-4051:2qfatqzg][You must be registered and logged in to see this link.]

Great find willowsend well done