# National Revenue Agency: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Data Protection Commision of Bulgaria (KZLD)
- Date: 2019-09-03
- Original: https://www.enforcementtracker.com/ETid-140
- Canonical: https://overview.legal/posts/46255
- Topics: Personal Data, Integrity and Confidentiality Principle, Public Authority, Education, Public Sector, Processing, Supervision

## Summary

The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I. was unlawfully collected and subsequently used to form an enforcement case against her for recovery of the sum of EUR ca. 86, 569. In relation to the enforcement case formed, additional data concerning the bank accounts of G.B.I was collected by the National Revenue Agency from the register of the Bulgarian National Bank.

## Full text

The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I. was unlawfully collected and subsequently used to form an enforcement case against her for recovery of the sum of EUR ca. 86, 569. In relation to the enforcement case formed, additional data concerning the bank accounts of G.B.I was collected by the National Revenue Agency from the register of the Bulgarian National Bank. The additional collected data was also unlawfully processed by the National Revenue Agency in sending distraint orders to the banks with which G.B.I. had bank accounts.

GDPR Articles: Art. 6 (1) GDPR, Art. 58 (2) e) GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/46255 · 2026-08-22