Personal data protection is one of the leading topics in the field of modern technology. The European Union has adopted the new Regulation (EU) 2016/679 (known as GDPR) namely to ensure a high level of protection for all natural persons whose personal data is subject to processing. One of the focal points of the Regulation is the so-called “right to be forgotten”.
The up-to-date version of the Personal Data Protection Act applicable in the territory of the Republic of Bulgaria provides an opportunity for every natural person to request the deletion of their personal data when their processing does not meet the requirements of this Act.
The provisions of the new Regulation significantly extend this possibility. Since its entry into force in May 2018, data subjects will have the right to file a request to a particular administrator to delete their personal data without undue delay in several hypotheses, one of which is to withdraw the consent of the natural person, on which the processing of the data is based.
Upon such a request, the administrator who made the data publicly available will be obliged to notify all other administrators who administer this personal data, as under the Regulation they will also be obliged to delete any links leading to them. The administrator – publisher of the website has a limited range of derogations allowing him to refuse such deletion (for example, in connection with journalistic, academic, artistic purposes, etc., as well as in case of processing for public interest archiving purposes, for scientific or historical research or for statistical purposes).
The European Court of Justice in Case C-131/12 from May 13, 2014 Google Spain SL, Google Inc. in the Español de Protección de Datos, Mario Costeja González, explained that the activities performed by search engines such as Google are considered as personal data processing that can significantly affect the fundamental rights of privacy and personal data protection as it makes it easier for users to build detailed profile of the person concerned. This type of administrators is required to delete the particular indexing from the list of results as well as the links to webpages that have posted information about the latter.
In the near future, a draft law amending and supplementing the Law on Personal Data Protection will is expected to be introduced, which will specify, clarify and regulate at national level many of the provisions of the Regulation.
author: Zlatka Kotsalova, lawyer
Member of “Velinov and partners” Consulting House
