In November 2019 the Constitutional Court of the Republic of Bulgaria by issuing Court Decision № 8 of 15 November 2019 under Constitutional Case 4/2019 (the “Court Decision”) declared Article 25з, para (2) of the Bulgarian Personal Data Protection Act (“PDPA”) contradictory to the Constitution of the Republic of Bulgaria and, hence, invalidated the provision.
The Court Decision was promulgated in State Gazette, Issue 93 of 26 Nov 2019 and came into full force and effect 3 days after that. The Court Decision has the direct effect of a law automatically amending Article 25з of PDPA – to the effect that it does not include para (2) – ex nunc.
PDPA was materially amended earlier this year (State Gazette, Issue 17 of 26 Feb 2019) to implement Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”).
The main purpose of the newly adopted Article 25з of PDPA was to implement the journalistic exemption under Article 85 of GDPR, i.e., to set forth the Bulgarian local rules regarding processing of personal data in situations where the right to the protection of personal data under GDPR collides and needs to be reconciled with the right to freedom of expression and information, such as in cases of processing of personal data for journalistic purposes and/or for the purposes of academic, artistic or literary expression (such purposes together, “journalistic and expression purposes”).
To appreciate the implications of the Court Decision, it would be helpful that you first understand the relevant provisions of Article 25з of PDPA. Paragraph (1) provides that processing of personal data for journalistic and expression purposes shall be lawful if and to the extent it is carried out for the purposes of exercising the right to freedom of expression and information and provided that the right to privacy of the relevant data subject is respected.
Paragraph (2) stipulates that the balance between the freedom of expression and right to information, on the one hand, and the right to protection of personal data, on the other hand, that must be stricken for the disclosure of personal data processed for journalistic and expression purposes shall be reviewed and verified based on the following criteria, as relevant: (i) the nature of personal data; (ii) the effect of disclosed personal data on the data subject’s privacy and reputation; (iii) the circumstances under which the data controller has collected relevant personal data; (iv) the type and nature of the disclosure by which the freedom of expression and the right to information are exercised; (v) the significance of the personal data disclosure for a matter of public interest; (vi) whether or not the data subject is an official holding office under Article 6 of the Bulgarian Anticorruption Law or a person who due to his/her official standing, activity or role in society is entitled to a lower level of personal data protection or whose actions may influence society; (vii) the data subject’s contribution to the disclosure of his/her personal data; (viii) the purpose, content, format and consequences of the disclosure made for journalistic and expression purposes; (ix) compliance of the disclosure with the protection of fundamental human rights; and (x) any other revenant circumstances.
According to paragraph (3), where processing is carried out for journalistic and expression purposes and the balancing test between the data subject’s privacy rights, and in particular his/her right to personal data protection, on the one hand, and the right of other involved subjects’ to freedom of expression and information, on the other hand, is met, Articles 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 10 (Processing of personal data relating to criminal convictions and offences), Article 30 (Records of processing activities), Article 34 (Communication of personal data breach to the data subject), and Chapter V (Transfers of personal data to third countries or international organizations) of GDPR and Article 25в of PDPA (requiring a parent/guardian consent for the processing of child’s personal data where the child is younger than 14 years of age) shall not apply as well as the data controller or processor may lawfully refuse to respect data subject’s rights under Articles 12-21 of GDPR in full or in part.
The remaining paragraphs (4) and (5) of Article 25з are irrelevant to the Court Decision.
Thus, structure-wise, while para (1) of Article 25з outlines the situation in which the exemption may, but does not necessarily, apply, para (2) recognizes that in each and every specific case of such situation a balance between the colliding right of a data subject to personal data protection and the right of other involved subjects’ to freedom of expression and information, need to be sought and provides guidance and criteria by which such balance to be checked in order for the data controller or processor to avail of the exemption. Paragraph (3) sets forth the very exemption.
The Constitutional Court has found out that para (2) of Article 25з is contradictory to the Bulgarian Constitution. Pursuant to the Court Decision the reviewed provision is in contradiction to Article 4, para (1) of the Constitution of the Republic of Bulgaria. Said article of the Constitution sets forth that Bulgaria is a country of the rule of law and that it shall be governed in accordance with the Constitution and the laws of the country. Two seem to be the main reasons for the Constitutional Court to reach to this conclusion. Firstly, the court finds the balancing test criteria under para (2) of Article 25з unclear, generically worded and not sufficiently specific. The court is further concerned that instead of being exhaustive, the list of circumstances to be taken into account for the purposes of reconciliation of the colliding rights is open-ended. On these grounds, the Constitutional Court concludes that the reviewed provision of PDPA creates a major legal issue with respect to the overall applicability of the journalistic exemption and causes uncertainty and legal insecurity in the state and in this way contradicts to the rule of law in Bulgaria.
Secondly, the Constitutional Court reads Article 25з, para (2) of PDPA as giving preference and privilege to the right of personal data protection before the right to freedom of expression and information. According to the court, the reviewed provision introduces a hierarchy among the human rights in which the right to privacy and personal data protection stands higher than other relevant human rights. The Constitutional Court further finds out that Article 25з, para (2) of PDPA unnecessarily restricts the processing of personal data for journalistic and expression purposes and creates a disproportionate barrier to the freedom of speech and expression. According to the court, means that are less intrusive to the freedom of speech and to the right of information may be used to reconcile the collision at hand. Therefore, the court concludes, Article 25з, para (2) of PDPA is contrary to the principles of the legal system, threatens the rule of law in Bulgaria and, hence, needs to be invalidated as incompatible with the Constitution.
It is worth noticing that the Constitutional Court gives the reasoning for the ruling after recognizing and by referring to a number of relevant decisions of the Court of Justice of the European Union (“CJEU”) issued under EU privacy and data protection law and of the European Court of Human Rights (“ECHR”), under the European Convention on Human Rights, respectively.
At the end of its reasoning in the Court Decision, the Constitution Court expresses an opinion that the invalidation of Article 25з, para (2) of PDPA will not prevent the full implementation of GDPR in Bulgaria, since, according to the court, when adjudicating on cases under Article 25з of PDPA Bulgarian courts may follow the existing case law of CJEU or, as the case may be, refer to the CJEU for preliminary adjudication under Article 267 of the Treaty on the Functioning of the European Union.
The Court Decision invalidates only paragraph (2) of Article 25з of PDPA. All other paragraphs stay in full force and effect.
The Court Decision has material legal implications for data protection in Bulgaria. It is final and binding to all subjects and institutions and to the entire judiciary in Bulgaria.
By invalidating Article 25з, para (2) of PDPA the Constitutional Court has left the journalistic exemption under Article 85 of GDPR without any real content. In view of the structure of Article 25з (as reviewed above) now the exemption is de facto unimplemented in Bulgaria. The remaining paragraphs (1) and (3) of Article 25з only reiterate sections of Article 85 of GDPR without providing for a meaningful reconciliation of the rights. From a Member State perspective this implies failure for Bulgaria to fulfil its obligation under Article 85, para (1) of GDPR. From a data subject perspective this implies unchecked and unbalanced exposure to personal data and other privacy breaches by data controllers and processors processing personal data for journalistic and expression purposes.
The Court Decision actually creates the legal ambiguity and uncertainty that the Constitutional Court claims in its reasoning to the Court Decision to be the legal grounds for the unlawfulness of Article 25з, para (2) of PDPA. Invalidated paragraph (2) of Article 25з clearly set forth that a balancing test was necessary in order for a data controller or processor to establish whether or not the journalistic exemption from GDPR was applicable and provided guidance and criteria for such test. By derogating this provision, the Constitutional Court leaves the interpretation of Article 25з, para (1) of PDPA in a vacuum. Following the Court Decision, it is now unclear: (i) whether or not any balancing test with respect to the reconciliation of the right to the protection of personal data with the right to freedom of expression and information is required at all when personal data is processed for journalistic and expression purposes, and (ii) if a balancing test is required, under what criteria it has to be made, as the criteria that used to be set forth in Article 25з, para (2), is found unconstitutional.
The identified uncertainty is further exacerbated by the fact that the invalidated provision of Article 25з para (2) was based on relevant case law of CJEU and ECHR. The Bulgarian regulator and legislator summarized such case law in a law provision to address the local, country-specific, need for regulatory clarity and guidance on the otherwise general rules in the area of privacy and, in particular, in the area of data protection. By declaring the criteria under Article 25з para (2) as unconstitutional, the Constitutional Court seems to “overrule” the relevant case law of CJEU and ECHR. This raises legal concerns, since in the area of human rights and fundamental freedoms (including, inter alia, protection of personal data and freedom of speech and expression) the case law of CJEU and ECHR by operation of the law is fully applicable and has direct effect in Bulgaria and Bulgarian courts must adjudicate in accordance with such case law.
The Court Decision is disturbing in yet another aspect. It indicates that the majority of the judges sitting on the bench of the Constitutional Court – these that have signed and approved the Court Decision – do not fully appreciate the protection of personal data as per GDPR and its historical development prior to GDPR as well as the nexus between EU rules and local, country-specific, rules governing the area of personal data and privacy in general. This indication per se has a detrimental effect for the rule of law in Bulgaria.
In this relation it is fair to recognize that not all judges from the Constitutional Court agreed to the Court Decision. Four of all twelve judges expressed a disagreeing (special) opinion on the majority ruling and their reasoning to the opinion shares the concerns expressed hereinabove. Unfortunately, it is the majority ruling, and not the disagreeing (special) opinion of the minority, that constitutes the Court Decision and produces a legal effect.
How Bulgarian courts will interpret and apply the Court Decision in cases where a data controller or processor relies on and claims applicability of the journalistic exemption from GDPR remains to be seen. A number of such cases on the matter may reasonably be expected to come up in the following years.
It will be also interesting to see how the Bulgarian Commission for Personal Data Protection, as the local regulatory and supervisory authority in the area of data protection, will apply Article 25з of PDPA, as amended by the Court Decision, in its activity. Surely, it will not be an easy task for the Commission.
For us, lawyers and legal counsels qualified under Bulgarian law, remains the unpleasant duty to advise clients about the uncertainty and the associated legal risk that have arisen as a result of the Court Decision with respect to the journalistic exemption. When asked about possible remedial actions to mitigate such risk, we will be forced to clarify to the client that the risk is systemic for the jurisdiction.