Bulgarian Commission for Personal Data Protection

In August 2019 the Bulgarian National Revenue Agency ("NRA") was fined for data breaches notified to the Bulgarian Commission for Personal Data Protection ("CPDP") on 17 July 2019. The inquiry commenced on 22 July 2019. In its decision, the CPDP found that there was an infringement of Article 32 (1) (b) of the GDPR. It established that NRA's failure to implement the necessary technical and organisational measures had resulted in an unauthorised access, disclosure and distribution of personal data of more than 6 000 000 natural persons. The compromised personal data included names, addresses and contact information, as well as data from individuals' annual tax returns, information relating to their personal income tax position, insurance declarations and health insurance premiums, as well as data on tax payments they had completed and on VAT refunds claimed and received. In addition to imposing a fine, the CPDP announced it had ordered the NRA to undertake a number of actions designed to improve its data security practices.