Bulgaria: The president vetoes local law implementing the GDPR

The Court of Justice of the European Union (“CJEU”), with its recent judgement, has set the course for the Croatian legislator attempting to intervene into existing contractual relationships. On 14 February 2019, the CJEU delivered a judgment concluding that a national law of an EU Member State cannot retroactively invalidate loan agreements that were deemed valid at the moment of execution. This is a rather expected outcome of recent controversial legislative intervention by the Croatian Parliament.

The President used its right to veto the Implementing Law, since it has disputed the provision of Article 25z. Article 25z proclaims that data processing for journalistic, academic, artistic or literary purposes is only lawful when:

• it is carried out in the context of exercising the freedom of expression and the right to information; and
• the privacy and personal life of the data subjects are respected.

Article 25z further sets out a list of criteria to be considered and observed by journalists, academics, literary authors, etc. in their data processing, which should be considered in order to assess the balance between the freedom of expression and right to information on the one hand, and the protection of privacy, on the other. Thus, Article 25z requires journalists, academics, artists and writers, in the course of their research and publishing to consider:

• the nature of the personal data;
• the impact the public disclosure of the personal data would have on the privacy of the data subject and his/her reputation;
• the circumstances under which the personal data have become known to the data controller;
• the character and nature of the statement by which the freedom of expression and information have been exercised;
• the importance of the public disclosure of personal data for clarifying a matter of public interest;
• whether the data subject is a person who holds a position under Art. 6 of the Counter-Corruption and Unlawfully Acquired Assets Forfeiture Act or is a person who due to the nature of his / her activity or role in public life, has a lesser degree of protection of his / her privacy or whose actions have an impact on society;
• whether the data subject has contributed to the disclosure of his / her personal data and / or information on his or her personal and family life;
• the purpose, content, form and consequences of the statement by which the freedom of expression and information has been exercised;
• the compliance of the statement by which the freedom of expression and information have been exercised, with the fundamental citizens’ rights.

The above list of proportionality criteria is set as non-exhaustive, thereby leaving room for wide and subjective interpretations and vast discretion of the controlling authorities upon enforcement of data privacy rules. This in turn is opening the door for control over the work of journalists, academia and artists. The President outlined that in fact this new provision undermines the freedom of speech and access to information and may affect the independence of journalists and academics.

2. Relation of Article 25z to the GDPR

The GDPR in Article 85 grants legislative discretion to the Member States in the area of data processing for journalistic, academic, artistic, or literary purposes to adopt appropriate measures to reconcile the right of protection of personal data with the rights to freedom of expression and information. However, the GDPR itself does not set specific proportionality criteria, nor envisages obligation to the Member States to develop detailed sub-regulation in this regard.
Thus, the approach of the Bulgarian Parliament, introducing a whole new set of rules without sufficient motives and legal argumentation, raises concerns for being unjustifiably disproportionate and burdensome to journalists, members of academia, literary authors, etc., having to conduct lawfulness and proportionality assessment in each separate case, which does not seem to be the purpose behind the GDPR.

3. The Stakeholders’ concerns

Although the new Article 25z did not provoke significant debates during the parliamentary discussions, following the official approval of the Implementing Law, an immense and highly negative response from journalists, local media associations and NGOs was received. As a result of the public reaction, the Bulgarian President exercised his veto right and returned the Implementing law to Parliament for further discussions on the controversial provision. 
According to the motives to the Presidential veto, the main concern with Article 25z is that it over-regulates the subject matter by introducing excessive requirements for the lawful data processing for journalistic purposes and the purposes of academic, artistic or literary expression. The ultimate concern behind being that Article 25z could potentially open the door for censorship concealed behind the controlling powers of the Commission for Personal Data Protection (“CPDP”) and lead to exertion of political pressure and informal censorship on local media. The local data protection authority enjoys the powers to exercise control over the compliance with the proportionality criteria set by Article 25z and respectively, is entitled to impose significant fines in case of established violations. Given the high amount of sanctions set forth in the GDPR, most of the smaller/independent media in Bulgaria could easily get insolvent if faced with the impossible financial burden of the GDPR fines.

4. Next steps after the President’s veto

Following the President’s veto, the controversial article of the Implementing Law is to be returned for further discussions by the Bulgarian Parliament. The veto can be overridden if the Parliament adopts the Implementing Law with a majority of more than half of all members of Parliament. In this case, the President shall promulgate the Implementing Law in the State Gazette within 7 days as of its receipt.