Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Bulgaria: CPDP publishes list of personal data processing requiring prior consultation

The Commission for Personal Data Protection ('CPDP') announced, on 10 June 2022, that it had adopted, on 1 June 2022, a list of personal data processing operations for which prior consultation is mandatory under Article 65(3) of the Protection of Personal Data Act 2002 (last amended in 2019) ('the Act').

In particular, the list clarifies that controllers and processors under Chapter Eight of the Act should consult the CPDP before starting to process personal data that will form part of a new personal data register in all cases where a particular type of processing is likely to result in a high risk to the rights and freedoms of data subjects, including in the cases referred to in Article 65(1) of the Act, as well as in the following types of processing operations:

  • regular and systematic processing of data on the location of persons by technical means for the purpose of controlling compliance with a detention order under Article 58 of the Code of Criminal Procedure;
  • large-scale processing of children's personal data for the purposes of preventing, investigating, or detecting antisocial acts or offences committed by or against minors, including for the purposes of implementing educational measures or penalties;
  • large-scale processing of special categories of personal data pursuant to Article 51(1) of the Act, where this is related to automated decision-making, including for the purpose of carrying out criminological analysis;
  • carrying out systematic large-scale surveillance of publicly accessible areas where this is related to automated decision-making, including facial recognition; and
  • undertaking data migration from existing to new technologies where this involves large-scale data processing.

Separately, the CPDP noted that the list is non-exhaustive and can be updated if necessary.

You can read the announcement here and the list here, both only available in Bulgarian.