On 29 August 2019 the Bulgarian Commission for Personal Data
Protection ("CPDP") announced first
significant fines under the GDPR[1]
for data processing breaches. The fines, which in total are more
than 6 million Bulgarian levs (approx. 3 million EUR), clearly
indicate the CPDP intention for strong measures in cases of data
leakages, irrespective of whether they concern public authorities
or private entities.
Background of the cases
- National Revenue Agency
(''NRA'')
On 15 July 2019 an anonymous hacker successfully breached the
security systems of the Bulgarian National Revenue Agency
(''NRA'') and downloaded the
personal data of over 5 million Bulgarian citizens. Part of the
hacked information (about 11 GB) was leaked to local media. This is
the biggest personal data breach in Bulgaria up to present date.
After the initiated inspection and discovery of highly insufficient
measures for protection of personal data the CPDP fined the
Bulgarian NRA with a 5.1
