Despite media impact worries Bulgaria begins to implement GDPR amendments

The EU’s General Data Protection Regulation took another step towards being integrated into Bulgarian law last week, when MPs in Sofia gave the green light to the second and final reading of changes to the nation’s data protection legislation.

The approval motion came amid a wave of doubts raised by a number of political groups claiming that the amendments could undermine media freedom in Bulgaria.

Among changes made in a list of ten newly introduced legal elements, concerns the use of personal data for “journalistic purposes and the purposes of academic, artistic or literary expression,”

One of the new provisions lists 10 criteria regarding the use of personal data for “journalistic purposes and the purposes of academic, artistic or literary expression,” the Sofia Globe reports.

In previous drafts, the changes came under fire from a transparency NGO named the Access to Information Programme, which argued that the provision could impinge of the freedom of media outlets should they wish to criticise the regime.

However, the provision was altered at committee stage to say that the criteria would be used “to judge the balance between the freedom of speech and the right to personal data protection, as applicable.”

While the defined criteria were drawn from cases presented to the European Court of Human Rights, there was no clarification as to whether placing them within Bulgarian law would lead to a “precise balance” that would necessitate being seen from legal implementations in future.

Among the issues challenged, are the nature of the data, how a subject’s name and personal life would be impacted under public disclosure, public interest levels in said public disclosure, how the data was acquired, and “the goal, contents, format and repercussions of the publication,” the head of the Access to Information Programme’s legal team, Alexander Kashumov, wrote in a blog post last week.

Furthermore, the changed law provides new strengths to Bulgaria’s data protection commission to execute checks that the criteria have been met and to launch administrative measures if it is decided that a breach of data protection law has taken place. However, the commission’s actions are not allowed to stand on the toes of protection afforded to journalistic teams, the amended law states.

Penalties for breaking this provision would be established under article 83, paragraph 5 of GDPR, which can bring about fines of up to €20m or up to 4% of annual turnover, whichever is higher.

Government-run organisations will also be able to stand in the way of access to information requests based on data protection developments.

A media freedom NGO called the Association of European Journalists-Bulgaria, attacked the bill, claiming it runs contrary to the ethos of the GDPR and that it fails to uphold freedom of speech, which is very much against the grain of Bulgaria’s constitution which champions free speech.

The group has appealed to President Roumen Radev to send the bill back to Parliament.


PrivSec Conferences will bring together leading speakers and experts from privacy and security to deliver compelling content via solo presentations, panel discussions, debates, roundtables and workshops.

For more information on upcoming events, visit the website.

We have been awarded the number 1 GDPR Blog in 2019 by Feedspot.