BulgariaGDPR Article 9 and PDPA Employment and National-ID-Number Rules
Regulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in Bulgaria.NIST Privacy FrameworkCT.PO-P1
- Do not let the Bulgarian national identification number (ЕГН) be the only means of identifying a user of a remote electronic service, and do not allow free public access to information containing it unless a law provides otherwise.NIST Privacy FrameworkPR.AC-P6NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text. Also read by: Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria) (guidance, recorded ); Case C-65/23 K GmbH (Employment-data rules), judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.AC-P6Individuals and devices are proofed and bound to credentials, and authenticated commensurate with the risk of the transaction (e.g., individuals’ security and privacy risks and other organizational risks).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065
- Guidance link
- https://cpdp.bg/%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%B8%D1%89%D0%B5-%D0%BD%D0%B0-%D0%BA%D0%B7%D0%BB%D0%B4%D0%BB-%D0%BE%D1%82%D0%BD%D0%BE%D1%81%D0%BD%D0%BE-%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD%D0%BE%D1%81%D1%8A%D0%BE/
- Case citation
- Case C-65/23 K GmbH (Employment-data rules), judgment of the Court of Justice of (First Chamber)
- Guidance body
- Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria)
- Open questions
- Does the six-month retention rule for the data of job applicants in Article 25k(1) of the Personal Data Protection Act contain the suitable and specific measures that Article 88(2) of Regulation (EU) 2016/679 requires of a rule on employment data?
What it makes you log
Log retention
A ceiling on how long an employer keeps the personal data of recruitment candidates, extendable only with the candidate's consent. It limits storage of the data itself and is not a duty to keep a record.
- Unit
- Months
- As of
- Basis
- Fixed
- Maximum value
- 6
Logging duty
The Act's additions in this row restrict copying identity documents (Article 25g), cap the time an employer keeps recruitment candidates' data (Article 25k) and limit use and public access of the national identification number (Article 25zh); none requires a person to make, keep or produce a log or record. GDPR Article 9 is a prohibition with exceptions, and its own text asks for no record.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Apart from a definition that refers to GDPR Article 4(14), the only provision of the Act that names biometric data is Article 51. It sits in the chapter for competent authorities processing personal data for criminal-justice purposes.
The Act's own additions sit instead in employment data and in protecting the Bulgarian national identification number (ЕГН, Edinen grazhdanski nomer, Unified Civil Number, English: EGN). A controller may copy an identity document, a driving licence or a residence document only if a law provides for it (Article 25g). An employer sets a retention period for the personal data of recruitment candidates of no more than 6 months, unless the candidate consents to a longer period (Article 25k).
Free public access to information containing the ЕГН is not permitted unless a law provides otherwise (Article 25zh(1)). A controller providing services electronically takes technical and organisational measures so that the ЕГН is not the only means of identifying a user of a remote service (Article 25zh(2)).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .