Some notes/reminders for data controllers based on the Bulgarian Personal Data Protection Commission’s practice from the last quarter of 2020:
1. The requirement for a timely and motivated response to a data subject’s request (e.g. for access to or erasure of her/his personal data) is a separate obligation of the data controller and its violation is subject to a fine even where the rejection of the request itself is lawful. Under Art. 12, para. 4 of the GDPR if a controller does not take action on a request of a data subject, it must inform the data subject at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint and seeking a judicial remedy.
2. Where a data controller cannot identify the data subject making a request, it should not refuse to act on the request, but should proactively request the provision of additional information necessary to confirm the identity of the data subject pursuant to Art. 12, para. 6 of the GDPR.
3.Data controllers need to make sure that they have proper procedures in place to respond to data subjects’ requests promptly.
4. The GDPR applies in full irrespective of whether the personal data concerned is publicly available or not. Thus, data controllers should always have a legal ground appropriate to the purpose when they process personal data obtained from public sources.
5. In its Opinion № ПНМД-01-96/2020 the Commission finds that placing face recognition and temperature measuring cameras as part of the premise’s access control does not meet the requirements for legality and proportionality, in particular of Art. 5, Art. 9 and Art. 22 of the GDPR, thus the control should be realized in other ways that do not require processing of special categories of personal data (unless the data subject freely provides an explicit consent). Measurement of body temperature, as part of the anti-epidemic measures, can be carried out without the data being recorded/stored. The Opinion concerns the access regime introduced by a school, but may be broadly applied to other employers in Bulgaria as well.
The information contained in this article is not a legal advice and should not be relied or acted upon as such.