2009

Excerpt from AIP annual report Access to Information in Bulgaria 2009:

Personal Data and Police Registration

The protests in the beginning of 2009 raised questions related to the protection of personal data as it turned out that the policemen photoed and registered the identification of the participants in the protests. Affected citizens asked AIP if the police forces had the right to register the data of the participants in the protests; was there the so called police registration and what exactly was it; was the processing of personal data by the Ministry of Interior legal in cases of police registration. Our consultations were based on the provisions of the Regulations for Police Registration issued by the Ministry of Interior on 29.01.2004 . According to it, the police forces have the right to register at the presence of data for intentional crime. In that case there was a violation of the Personal Data Protection Act by the police forces.

Personal Data in Social Networks

AIP was addressed for consultation in one of the first cases in Bulgaria of identity theft in a social network. In September, a 21 years old mother from the town of Plovdiv signals the police that cheaters had used the picture of her one-year old son in the Internet by announcing that he was ill and needs funds for the treatment. The questions to AIP, mainly from journalists, were related to the right of protection of personal data and privacy of citizens in social networks like Facebook, LinkedIn, Netlog, etc. In the provided consultation, we pointed out that the Personal Data Protection Act does not protect us when we have published ourselves information about our personal life (Art. 5, Para. 1, Item 5). Citizens should know that the responsibility for the protection of their own personal data in the social networks is theirs. The development of the information society requires a new type of culture and habits and everybody should be careful with where and what type of information do they publish on the Internet. Once uploaded or published, a material or a picture stops to be personal and everybody can use them. The publication of personal information may have serious consequences for the personal and professional life.

Personal Data in the Conflict of Interests Declarations

In the beginning of 2009, the Prevention and Disclosure of Conflict of Interests Act became effective (PDCIA, promulgated in State Gazette, issue 94, 31. 10.2008) which introduced rules for the prevention and disclosure of conflict of interests of persons holding public positions. Pursuant to Art. 12 of the law, these persons shall submit several explicitly listed declarations: declaration for inconsistency, declaration for private interests, declarations for change of conditions, and declaration for private interest in a particular case. Declarations are accessible to everyone who request information under the provision of Art. 17, Para. 2. Pursuant to that provision, the declarations shall be published on the web site of competent bodies in compliance with the requirements of the Personal Data Protection Act. That provision raised a lot of questions with regard to the implementation of the law. Questions were referred to AIP, especially from public officials. Among the most frequent questions were: which information stated in the declarations under Art. 12 of the PDCIA is protected under the Personal Data Protection Act; which part of the declared information shall be published so that the provisions of the Personal Data Protection Act are respected; are copies of the declarations subject to provision after a request for access to information considering the provisions of the PDPA, etc.

At the same time, the Committee for Personal Data Protection issued two identical decisions after being addressed several times for official statement on the implementation of the problematic provision. The decisions stated that every information in the declarations under Art. 12 , Para. 1 may constitute personal data under the Personal Data Protection Act. That was why, the disclosure of personal data from the declarations shall be done after an explicit written consent of the declaring person, attached to the same declaration. Thus, having the consent of the physical person for the processing of their personal data by publication in the Internet, their rights would be protected to the greatest extent, the Committee stated/

 
AIP does not accept this interpretation as it contradicts the spirit of the law. The obligation established by Art. 17, Para. 2 of the PDCIA for disclosure of the declarations means nothing but the publication of declared data. No additional personal data like Personal Identification Number shall be published, however.