2012
In 2012, AIP continued receiving for consultation cases concerning violations of the right to protection of personal data, a part of the citizens’ privacy. Let us mention some of the emblematic cases that caused an active public reaction. The first two cases show attempts by personal data administrators to process a larger amount of personal data than actually needed for accomplishing the stated purposes, thus infringing the principle of proportionality of data processing laid down in Article 2, paragraph 2, item 3 of the Personal Data Protection Act (PDPA).
Registers of children between 0 and 7
“Public transportation subscription cards for babies too” – similar humorous titles appeared on the pages of the print and electronic media in the late summer in 2012. At the same time a parent from Plovdiv who was asked for copies of personal documents (identity cards, birth certificate and photo of the child), as a condition for the issuance of a free public transport card for his two-year old child, turned to AIP for legal advice. The question which raised this case is why for the issuing of such cards that only certify, but do not create the right to free public transport, should be established new registers containing annually updated personal data on parents and children.
This story started on 21 December 2011 when the Council of Ministers (CoM) adopted Decree no. 352 amending Decree no. 66 of 1991 on setting minimum amounts of the reductions of public transport prices on automobile transport for certain groups of citizens. As a result of these amendments, mandatory issuance of free subscription cards for public transportation to persons between 0 and 7 years old was introduced. The organization of the issuance was to be carried out by each municipality following the Ministry of Transport guidelines. Since no guidelines were published till mid 2012, the municipalities created their own regulations on the issuing of free public transport cards for the children between 0 and 7. Thus it turned out that in some municipalities such as Varna and Plovdiv in implementation of this objective, special new registers have been established for processing of personal data, which should be updated annually.
The AIP team considers that the described case constitutes a violation of the principles of proportionality and expediency of data processing set out in the PDPA. Pursuant to Article 2, paragraph 2 of the PDPA, any action of data processing should be carried out in accordance with the above principles. In this case, in order to respect the principles of the PDPA, the concerned individuals should only prove their right once by producing a proper reference document.
In practice there were established new, completely unnecessary registers of personal data of individuals. We consider and recommend that this practice be stopped and the created registers - destroyed.
Personal data registers for the purposes of parking in Sofia
A similar problem in the implementation of the PDPA – personal data processing not proportional to the stated purposes – emerged concerning the 2012 amendments of the Ordinance on traffic organization on the Sofia Municipality territory adopted by the Sofia Municipal Council. Annex no. 15 (to Article 50a, paragraph 6) of the ordinance determining the “Terms and conditions for issuing a vignette sticker for locally paid parking of vehicles of owners of distinct residential properties falling within the zones of hourly paid parking.” According to the adopted earlier this year amendments, the property owners in the paid parking zones wishing to receive a parking sticker had to file an application, enclosing a copy of an identity card, a copy of the tax paid on the vehicle, a copy of the paid civil responsibility insurance, a copy of a proof of ownership of the property and a copy of a document of payment of a utility bill.
After a heated public debate on the subject, the ordinance and Annex no. 15 were amended, the requirement of copies of the documents was revoked and the number of required documents was significantly diminished.
Currently in order to issue the necessary vignette sticker for parking should be provided only for reference documents (and not copies to be left) certifying ownership of the vehicle and the property.
The police requested personal data of drug addicts
In the end of 2012, several media reported that by an official letter the Sofia Directorate of Interior (SDI) has requested from several health facilities lists containing the three names and personal identification numbers of all drug addicted citizens included in the special methadone programs. The first publication on the case is in the internet edition “e-vestnik”, where a facsimile of the letter signed by a chief of sector in the SDI was also published. The request for provision of the personal data lists is based on Article 159 of the Criminal Procedure Code [1]. The factual grounds of the request is that the SDI is investigating a series of burglaries in Sofia pharmacies committed by unknown persons, where besides money from the pharmacies had also disappeared drugs. This is why according to the police all drug addicts constitute a class of potential suspects.
The case provoked an instant reaction from journalists and human rights organizations, because obviously a specific group of people could not be presumed as collectively “guilty” only because of their specific health status. Immediately after the publication in the media, AIP published a statement that the actions of SDI constitute a breach of the fundamental principles of the right of protection of citizens personal data as a part of the constitutionally guaranteed right of everyone to privacy. The request for providing lists of persons included in methadone programs violates specific statutory guarantees of personal data protection. The Personal Data Protection Act provides a special, higher protection of health related data. Article 5 of the PDPA prohibits processing (respectively provision to third parties) of personal data, related to the persons’ health. Exceptions to this prohibition are provided for, but they are exhaustively listed in Article 5 of the PDPA and the purposes of criminal proceedings are not amongst them.
The case constitutes also a breach of Article 157, paragraph 1 of the Ministry of Interior Act prohibiting collecting information on citizens based solely on racial or ethnic origin, political, religious or philosophical convictions, membership in political parties, organizations, associations with religious, philosophical, political or trade union purposes, as well as on health or sexual life. In this case there is a discriminatory attitude towards people, suspected as a group of committing a crime solely on the basis of their health status - drug dependence.
Doctors of medicine working in the said methadone programs turned to AIP for legal advice. A motivated refusal for provision of the requested personal data was prepared for the SDI director.
Personal data protection in the use of Special Surveillance Means and traffic data
In 2012, AIP consulted cases related to breaches of the right of personal data protection in the sphere of the use of special surveillance means and traffic data surveillance by the competent authorities. This practice shows, firstly, that there is a broad interpretation of the Electronic Communications Act by the Ministry of Interior bodies, aiming at access to traffic data, and, secondly, that there is no possibility for citizens to have access to any whatsoever information whether special surveillance means have been used against them. In the autumn of 2012 AIP together with attorney-at-law Mihail Ekimdjiev and the Association for European Integration and Human Rights filed a complaint with the European Court on Human Rights which was against the whole system of surveillance and wiretapping provided for by the Special Surveillance Means Act (SSMA) and the Electronic Communications Act (ECA).
AIP’s practice in this area is also confirmed by the conclusions made in the 2011 Annual report on the activity of the subcommittee to the Legal Affairs Committee of the National Assembly which carries out the parliamentary oversight and monitoring under Article 34b of the Special Surveillance Means Act and Article 261b of the Electronic Communications Act (ECA).
The report was published in July on the National Assembly’s webpage. It contains aggregated information of the inspections made that show disturbing data. A decrease in the total number of requests for the use of SSMs was reported, but this decrease is due to the newly established vicious practice of combining multiple means of special surveillance in a single request. Regarding the Ministry of Interior bodies the number of requests for the use of SSM has increased. In 2011 an increase of 26% compared to 2010 was reported. The number of people subjected to SSMs increases. In 2011, special surveillance means were applied to 7,881 Bulgarian citizens. This is an increase of 30% compared to 2010. The application of wiretapping as an operative method also grows by 20% compared to 2010.
Based on the inspections results the special subcommittee made the following conclusions which AIP finds deeply disturbing from the viewpoint of the right to privacy:
- The use of SSMs by competent authorities is not being applied as “extraordinary” means only in cases where all other methods and means of operative research activity and investigations are exhausted. On the contrary, the investigating authorities use SSMs primarily as the most convenient method of gathering information.
- The scope of investigating authorities and officials authorized to request the use of SSMs and traffic data is too wide. Serious preconditions for violating the rights and freedoms of citizens are created.
- There is no sufficiently effective control by the judiciary. The oversight activity carried out by the parliamentary subcommittee leads to the conclusion that the refusals for the use of SSMs issued by district courts are not the rule but rather the exception (0,85% of all requests). It is necessary to increase the controlling role of the court and to provide for ongoing and ex post judicial overview of the information collected through SSMs and used by investigating authorities.
In addition to the parliamentary subcommittee conclusions AIP also expresses concern over the ever more frequently observed bypassing of the provided in the ECA judicial procedure of allowing access to traffic data. Next, in the ECA framework lacks a mechanism of informing citizens after a certain period of time and under certain conditions about the effectuated access to their traffic data. Therefore and in the view of achieving an adequate protection of citizens rights, AIP recommends that the legislator adopts the absolutely essential amendments to both laws – the SSMA and the ECA.
---
[1] According to this provision “at the request of the court or the bodies conducting pretrial investigations proceedings, all institutions, legal entities, officials and citizens must preserve and hand over these objects, papers, computerized data, including on traffic, which may be relevant to the case”.