The information was requested by Atanas Chobanov (BIRD) back in the summer of 2023. The first refusal of the National Revenue Agency (NRA) was repealed with a judgment of the Sofia-City Administrative Court (SCAC) dated November 2023, which was reflected in the respective AIP newsletter.
In its new ruling on the request, with a response dated 27 November 2023, the Executive Director of the NRA once again refused to provide the requested information on the grounds that it contained protected personal data within the meaning of the General Data Protection Regulation.
The new refusal was appealed before the SCAC with the support of AIP.
With Judgment No. 10945/5 July 2024 of the SCAC, Second Division, panel 40, on administrative case No. 1901/2024, Judge Diliyana Nikolova partially repealed the refusal and returned the case to the NRA for a new ruling on the information request, together with instructions on the interpretation and application of the law.
The court accepted that the requested information regarding the bank accounts, movable and immovable property of the individuals specified in the request, as well as the indication of their location, does not constitute public information as defined in Article 2, par. 1 of the Access to Public Information Act (APIA), since these information will not enable citizens to form their own opinion regarding the activities of the bodies obliged under the law, and the mere fact that the information is considered of interest is not sufficient to define it as public. The objective of the APIA is to promote transparency and to allow for public oversight of the activities of public bodies and local government bodies in relation to the exercise of their powers. Therefore, the characteristics outlined in the specified legal norm, which define information as public, must be present cumulatively. The absence of any of these characteristics excludes the application of the APIA regarding the information, as it is not public.
Furthermore, any information concerning bank accounts and the property of an individual constitutes personal data as defined in Article 4, item 1 of Regulation (EU) 2016/679: “personal data” means any information related to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Additionally, Article 2, par. 5 of the APIA excludes its applicability with regards to access to personal data.
The situation is different regarding the other part of the request, which relates to information concerning the activities of the obliged body. For example, in item 1, a question is raised about the progress of the audit conducted on Lyubena P., to which no answer has been provided. This information does not constitute personal data within the meaning of the above-mentioned definition, to which the APIA does not apply, but qualifies as public information under Article 2, par. 1 in conjunction with Articles 10 and 11 of the APIA. Similarly, public information is requested regarding the stage of audits performed or being performed on the other specified individuals, the extension of the deadlines for conducting them, the results, and whether the final decisions with which they were concluded have been appealed. This information relates to the exercise of powers by the obliged body and can allow citizens to form their own opinion regarding its activities. Therefore, the refusal issued with regards to this part of the request on the grounds of Article 2, par. 5 of the APIA is unlawful, as it followed from an incorrect application of the substantive law.
Furthermore, the requestor has invoked an overriding public interest. The onus to rebut the presumption introduced by the APIA is on the obliged body, and the lack of reasoning in the decision in that regard constitutes an independent ground for its revocation.
In view of the above considerations, the court held that the appealed refusal should be revoked as unlawful in the part where the requested public information was denied due to its incorrect classification by the defendant as personal data within the meaning of Article 4, par. 1 of Regulation (EU) 2016/679. The court returned the case file to the obliged body for a new ruling in the specified part.
The court judgment is final.
================================================
The publication is part of the project "Legal Help to Strategic Access to Information Cases". This project is funded by the United States Agency for International Development and the German Marshall Fund of the United States. All publications in the frames of the project are funded by the United States Agency for International Development and the German Marshall Fund of the United States. Its contents are the sole responsibility of Access to Information Programme Foundation and do not necessarily reflect the views of USAID or GMF.