Enforcement · Data Protection Commision of Bulgaria (KZLD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

National Revenue Agency: Insufficient legal basis for data processing

The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I.

€28,100 Fine
National Revenue Agency
BULGARIA
Art. 6 GDPR Art. 58 GDPR
Personal Data Supervision Integrity and Confidentiality Principle Public Authority Education
Sep 3, 2019 Source cpdp.bg

Full text

The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I. was unlawfully collected and subsequently used to form an enforcement case against her for recovery of the sum of EUR ca. 86, 569. In relation to the enforcement case formed, additional data concerning the bank accounts of G.B.I was collected by the National Revenue Agency from the register of the Bulgarian National Bank. The additional collected data was also unlawfully processed by the National Revenue Agency in sending distraint orders to the banks with which G.B.I. had bank accounts.

Industry: Public Sector and Education

How it connects

References

Related across sources

C-46/23 Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala v Nemzeti Adatvédelmi és Információszabadság Hatóság In a preliminary ruling requested by the Budapest High Court, the Court of Justice interpreted whether Article 58(2)(d) and (g) of the GDPR permits a national supervisory… CJEU ·Fifth Chamber Mar 14, 2024 Right to be Forgotten Personal Data Right to Restriction
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
C-175/20 SIA 'SS' v Valsts ieņēmumu dienests In Case C-175/20, the Court of Justice of the EU interpreted GDPR Articles 5 and 6 in response to a preliminary ruling from the Latvian Regional Administrative Court concerning a… CJEU ·Fifth Chamber Feb 24, 2022 Retention Period Personal Data Legitimate Interest
C-33/22 Österreichische Datenschutzbehörde v WK In Case C-33/22, the Court of Justice of the European Union (Grand Chamber) addressed a preliminary reference from the Austrian Verwaltungsgerichtshof regarding whether a… CJEU ·Grand Chamber Jan 16, 2024 Material scope (GDPR) Supervision Public Authority
29 K 3490/24 VG Düsseldorf: data subjects challenge district's sharing of personal data in water-law A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two… Administrative Court Düsseldorf Jun 22, 2026 Personal Data Supervisory Authorities Supervision
Related documents