Seven years after the leak of Ivancheva and Petrova's personal data from the indictment against them, Bilyana Petrova finally received a final judicial recognition that the special court violated her personal rights. The Supreme Administrative Court, Fifth Department rejected the appeals of the Prosecutor's Office of the Republic of Bulgaria and the Inspectorate to the Supreme Judicial Council, confirming the conclusions of the Sofia City Administrative Court that the Specialized Criminal Court and the Specialized Prosecutor's Office, in violation of the law, sent the personal data of the two women to the media.
The case for the illegal publication of the personal data was filed by Bilyana Petrova. In 2019 20 minutes of the court hearings in the bribery case against the two were leaked from the special justice system, as well as the paper recordings of wiretapping by the services during the investigation.
"The files are identical to the ones scanned by the special court, officially provided to us as a party to the case. Initially, they were classified as secret because conclusions can be drawn from them about the use of special intelligence tools by the competent institutions," Ivancheva and Petrova stated in a complaint to the then head of the Supreme Judicial Council, Lozan Panov, the Inspectorate at the Supreme Judicial Council, the “Cybercrime" Directorate at the Ministry of Interior and the Commission for Personal Data Protection. It also became clear that over 130 media outlets received the first-instance reasons for the convictions of Ivancheva and Petrova, without the personal data in them being deleted.
The Inspectorate at the SJC conducted an inspection and partially acknowledged the violation, but rejected the complaints of Ivancheva and Petrova against the SNC and the Specialized Prosecutor's Office for a violation in the processing of their personal data, which were contained in the distributed indictment and the minutes of the court hearings in the case.
The Inspectorate's conclusion did not correspond with the statements of Ivan Geshev, then Prosecutor General, according to whom the leakage of data from the proceedings was to give them publicity: "The only thing we can do in this situation, the prosecutors, to show that what we claim exists, and which can be seen on certain sites, because all the court hearings were held there, the indictment, the SRCs, is to give publicity... they are on the site. Read".
Lawyer Alexander Kashumov stated before the Supreme Administrative Court that he was perplexed by the persistence of basic institutions, which must respect the fundamental rights of citizens and enforce the law, not wanting to fulfill their commitments. He emphasized that this outrageous violation does not correspond to the due behavior of institutions in a country - a member of the European Union.
Meanwhile, the Commission for Personal Data Protection (CPDP) announced that the specialized criminal court, in its capacity as a personal data controller, had violated the provision of Art. 32 of the Regulation, for which reason it should be issued an "official warning". The Commission also noted that the leak was not the result of a hacker attack. Later, the court overturned the CPDP decision on procedural grounds, but the commission's conclusion that the violation was unconditional and there was no external attack on the specialist's computers is difficult to erase.
Regarding the ISJC's appeal, the Sofia City Administrative Court noted that the failure to exercise the powers of a supervisory authority for the protection of personal data, regulated in Art. 58, §1 of the GDPR, is a violation of the administrative procedural rules from the category of essential ones, since it directly influences the formation of the will of the administrative authority and predetermines the final result.
After hearing numerous witnesses, the ACPG pointed out that the court and the prosecutor's office cannot process personal data for journalistic purposes: "Under no circumstances can they disseminate the data of the persons they process in connection with judicial or pre-trial proceedings. When it comes to violating the presumption of innocence, not only the personal sphere of the person brought to trial is affected, but also the authority of justice and the rule of law".
The ACCG declared that the contested administrative act was unlawful as issued in the event of significant procedural violations, in contradiction with the substantive law and inconsistency with its purpose.
The Supreme Judges concluded that the ACCG's decision was correct and fully accepted its motives, defining it as justified and after a comprehensive in-depth analysis of the evidentiary material and the applicable substantive law.
The Court indicated that the conclusion of the first instance court that the SNC and the SP, as personal data administrators, should have established and proven before the supervisory authority (ISJC) that they processed the data collected for the purposes of the criminal proceedings with an appropriate level of security and protection.
The summary conclusion of the first instance court is that inadmissible processing of the complainant's personal data was carried out in the form of disclosure through transmission and dissemination, not falling under the exceptions under Art. 42, para. 2 of the PDPA.
With these considerations, the Supreme Administrative Court upheld the contested decision of the ACSC. The ISJC was ordered to pay lawyer Alexander Kashumov the amount of 1,000 leva as attorney's fees for the cassation instance.
The decision is final.