Bulgaria Update: The balance between freedom of expression and data protection

The balance between the right to freedom of expression and information and the right to data protection has been the center of discussion for quite some time now, especially in the context of journalistic activities. As both rights are not absolute, the question is – which right overrules the other?

In November 2021 the Supreme Administrative Court (Decision No. 11636 of 16 November 2021) rendered a rather significant decision that will not only determine the courts’ case law for the future but will also set an example of how media should approach personal data.

The case was initiated by a complaint of a public figure to the Commission for Personal Data Protection (CPDP) against an electronic media outlet. The media had publicly announced information about the person’s physical identity (names, PIN with the last four digits deleted, address), economic identity (property with a full address, description, price, entries, mortgage, deletion of mortgage, financial situation, participation, and membership in a non-governmental organisation) and social identity (profession, place of work, employment, affiliation information).

The media justified the publication of these data with journalistic purposes and argued that it used publicly accessible information from the Registry Agency.

In its argumentation, the Supreme Administrative Court supported the reasoning previously sustained by the Constitutional Court that the balance of these two competing rights requires a specific case-by-case assessment. The Constitutional Court annulled the provision of the Personal Data Protection Act stipulating fixed criteria regarding the admissibility of personal data processing for the purposes of journalism, academic, artistic, or literary expression. You can find more on the Constitutional Court’s decision and its impact here.

The Supreme Administrative Court emphasised that under the Personal Data Protection Act the processing of personal data carried out for journalistic purposes is lawful when carried out for the exercise of freedom of expression and the right to information, insofar as the privacy is respected. The decision stated that the online media outlet acting as a data controller has violated the principle of data minimisation, which resulted in the imbalance between the two rights. According to the argumentation of the Supreme Administrative Court, the need to inform the public about the facts and to preserve the topic of the article can be carried out successfully without indicating the date of birth of the public figure or the exact number of his apartment and the property identifier. The fact that this information is publicly available in a public registry does not justify the disclosure of personal data as the publication in the public registry has different purposes than media publications. Moreover, the information available in the public registry is not immediately accessible to the public, but a certain administrative procedure should be followed. The processing of personal data for the purpose of journalistic activity, therefore, is a completely separate processing with its own purposes, which should comply independently with the requirements of the GDPR.

The decisions of the Constitutional Court and the Supreme Administrative Court coincide with the jurisprudence of the European Court of Human Rights and the European Court of Justice.

The balance between the rights must be found through a rational and pragmatic approach that takes into account the specific circumstances of each case. The current line of interpretation is likely to be followed by other courts and will be the basis for establishing lasting case law in resolving disputes on the balance between freedom of expression and the right to information on the one hand and personal data protection on the other. There is no doubt that this decision will also have a significant social and public impact in the context of journalistic expression resulting in the media’s more considerate approach regarding personal data publication.  

The complete text of the Supreme Administrative Court’s decision can be found here.

By Dimitrov, Petrov & Co., Bulgaria, a Transatlantic Law International Affiliated Firm.  

For further information or for any assistance please contact bulgaria@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.