Bulgarian Commission for Personal Data Protection

In August 2019 DSK Bank was fined for a data breach. In its decision the Commission for Personal Data Protection ("CPDP") established that DSK Bank had infringed Article 32 (1) (b) of the GDPR by not being able to guarantee ongoing confidentiality and security of the systems and servers for processing personal data of individuals, which resulted in third parties having gained unauthorised access to personal data belonging to more than 33,000 customers of the bank. The data was recorded in more than 23,000 credit record files. Among the compromised personal data was data from national ID documents, income and health insurance information, as well as details concerning assessments of individuals' capacity to work.