DECISION
№ ПАИКД-01-56/2021 г.
IMI 320530
The Commission for Personal Data Protection (CPDP, Bulgarian SA) was a recipient
of an Article 56 of Regulation (EU) 2016/679 procedure, initiated by the Data Protection
Commission (Irish SA, DPC). The case is given the following registration number - №
ПАИКД-01-56/09.12.2021 г.
The CPDP has made an assessment of the merits regarding the present case. A draft
decision was adopted and submitted to the concerned supervisory authorities for their opinion.
A comment was received from the Irish SA within the statutory period envisaged in
the GDPR, with clarifications that do not raise objections to the draft decision on the merits.
The Irish SA considers that it should be emphasized that the Bulgarian SA has contacted the
complainant directly, and proposing a specific wording in that respect in the draft decision. In
addition, the inclusion of a statement in the draft decision regarding the complainant’s right
to an effective judicial remedy is requested.
The CPDP considers the clarifications made relevant and reasoned, and adopted
the following decision:
The Irish SA received a complaint lodged by a citizen who has a resident
status in Ireland. The subject of the complaint concerned the exercise of the right of access
pursuant Article 15 of the GDPR, which was not granted. The complainant has requested access
to any information that the data controller might hold about him, either on computer or paper,
identity documents that the individual has previously sent, chat logs and emails, related to the
creation of a user account and identification process, as well as the log files from when the
controller received the information from the data subject.
The complaint is against “IP Telecom Bulgaria” Ltd., with national registration number:
201274344 and address: Burgas 8000, str. "Vasil Aprilov" 2, floor two. The controller is a
company, which provides electronic communications services and as such, operates
www.zadarma.com – a platform for VoIP services that buys and sells telephone numbers from
the National Numbering Plan of the Republic of Bulgaria and other EU Member States. The
single place of establishment is Bulgaria
1
On 19 April 2021, purchased one of the products, offered on
the www.zadarma.com website, which he subsequently did not receive. He immediately
contacted the website’s support and was informed that his order was not fulfilled, because he
was a foreign citizen ( ), without taking into account his Irish Residence Permit. The
data subject decided to take a legal action against the controller, thus on 20 April 2021; he sent
an email to [email protected], requesting copies of the chats and personal data, concerning
him. Having received no reply, on 20 May 2021, he made the same request once again, however,
this time he included the email address of the DPC ([email protected]) in copy.
The Irish SA has carried out an investigation with regard to the website and found that
the complaint was filed by a data subject who resides in the territory of Ireland against a data
controller, whose single place of establishment is the Republic of Bulgaria. The complaint
concerns the processing of personal data carried out in the context of the activities of sites in
more than one Member State by a controller in the Union.
Based on the aforementioned, the DPC initiated an Article 56 procedure for
identification of a Lead Supervisory Authority (LSA) and Concerned Supervisory Authorities
(CSA) in the Internal Market Information System (IMI) – IMI 320530.
In connection to that, and in order to fully clarify the facts and circumstances of the
case, the Bulgarian SA requested the official statement of the controller.
In its response, “IP Telecom Bulgaria” Ltd. stated that due to a contractual obligation
towards the operators, from which the company purchases numbers from the Numbering Plan
of it is not entitled to provide the relevant numbers to citizens or companies.
This fact is explicitly stated in the www.zadarma.com website.
The company does not dispute the fact that on 19 April 2021 a request was received
from a citizen who wished to purchase a number. For this purpose, the
individual registered on www.zadarma.com and paid the specified price. However, in the course
of an internal verification by an employee of “IP Telecom Bulgaria” Ltd, it was established that
the person was not entitled to the relevant number due to the fact that he was a citizen.
An explanation in this regard was provided to the data subject by an employee of the controller,
and the price paid was immediately reimbursed in full. Although there is a proof of his Irish
residency, it does not invalidate the existence of nationality, and the fact that
citizens could not receive a number and, since the provision of numbers to
citizens by the company would be a serious breach of contract.
In its official statement, the company claims that no request for access to personal data
in any form has been received either at the relevant e-mail address - [email protected] ,
2
or at the e-mail address to which user requests can be sent - [email protected] . For this
purpose, the controller has carried out an internal investigation. It is noted that the website
explicitly states that requests for access to stored personal information should be made by e-
mail to [email protected] , and that especially trained privacy officers handle the requests.
In addition, it is noted that due to expired retention periods, as of the date of the
statement, 29 December 2021, the company has deleted the previously collected data
concerning identity and residence permit. The data that, at the time of the statement, were
available to the controller were accounting data for the amounts paid, or amounts returned, and
contact information, namely - names, telephone number and e-mail address that the data subject
had submitted when signing up. In addition, the data controller asserts that if a request were
received from a data subject, it would respond within the legally defined timeframes, but in this
case, it was unable to provide the individual with any information because no such request was
received in the company's email.
In connection with the statement provided by “IP Telecom Bulgaria” Ltd., the CPDP
makes an additional request for evidence, pertaining to:
1. Evidence of the explanations provided to the data subject;
2. Evidence that the amount paid by the data subject and the fact that the same was
promptly reimbursed.
With regard to the claims of the controller that the data subject did not ask for his official
statement on the print screens of the emails from 20 April and 20 May 2021, provided by the
complainant and enclosed to the complaint itself, relevant evidence was requested, namely:
1. Evidence of the erasure of data gathered from the complainant's identity
document;
2. Evidence of the accounting records, related to the subject’s reimbursement, as
well as contact information - names, telephone number and email address.
In response, an official statement, along with the requested evidence, was provided by
“IP Telecom Bulgaria” Ltd. In it, the data controller confirms that the e-mail
([email protected]) is managed by the company and that until the moment of receipt of
the letter from the Bulgarian SA, the company was not aware of the complainant’s emails. In
view of the situation, the controller assumes that it is possible that the emails in question could
have been placed in the “spam” folder for reasons unknown. The company informed that
messages in this folder are stored for a period of 1 month, after which they are automatically
deleted. Within 60 days of deletion, all log files for emails received in the spam folder, are also
automatically deleted, meaning that the controller cannot ascertain the reception of the emails.
“IP Telecom Bulgaria” Ltd. draws attention to the fact that a thorough internal investigation has
3
already carried out by the time of the first letter from the CPDP, in order to identify any access
requests, possible server/software deficiencies and the presence of a human error. No
deficiencies were established and no evidence was found as to the reception of the attached
emails. The controller stated that is not in a position to provide written evidence that the emails
in question were/were not received in the “spam” folder and were subsequently automatically
delated, as this is a negative fact that could only be linked with the complainant’s allegations.
Moreover, after receiving the last CPDP’s inquiry, with the enclosed print screens of
the emails sent, on 13 January 2022, the company contacted and
provided the personal data requested, as well as evidence, and apologized for the situation. Its
response is motivated by its desire to compensate the complainant for any mistakes, as well as
its obligation to provide the information requested within the legal timeframe, following the
actual reception of the request, which coincides with the CPDP’s letter – 10 January 2022.
As a result, the company has immediately modified the functionality of the “spam”
folder, so that fewer emails would be filtered, thus all requests, related to the exercise of the
rights of data subjects, and the right of access in particular, would be forwarded to the respective
employees as soon as possible, with the risk of receiving more junk/malicious emails.
As far as the evidence requested by the Bulgarian SA is concerned, first, the data
controller provides and extract from a conversation in a virtual chat room, with a translation in
Bulgarian. “IP Telecom Bulgaria” provides evidence for the full reimbursement of the data
subject and makes the following statement:
“We hereby submit a printout from the Company's PayPal account, which shows that
on 19.04.2021 we received a payment of EUR 25.83 from , of which EUR
24.49 was a service fee and EUR 1.54 was a fee deducted by PayPal, and on the following day,
20.04.2021, we refunded the amount of EUR 25.83 to the person in full.”
Regarding the evidence of the deletion of the personal data of the complainant, a written
protocol has been provided, which establishes that the files attached by the subject (that contain
personal data), were destroyed immediately after the access to the telecommunication service
was refused. An order of the company’s manager for the appointment of an employee,
responsible for the destruction of the personal data, was also enclosed.
With regard to the evidence of personal data processed, it is evident from the
conversation in the virtual chat room that the data subject has explicitly made a statement that
he does not wish his account on the platform to be deleted, and therefore the account is active.
The data controller provides an overview of the complainant’s personal data it holds at the time
of the submission of the statement.
4
During a session, held on 26 January 2022, on the grounds that the single place of the
establishment of the controller is on the territory of the Republic of Bulgaria, the Bulgarian SA
decided to act as a Lead Supervisory Authority, for which the DPC was notified.
The complainant has been duly informed, directly by the Bulgarian SA, of the actions,
taken by the controller and, taking into account that his access request has been fulfilled in the
course of the proceedings, he has been invited to specify whether or not he would maintain or
withdraw the complaint. No response was received.
During a session of the CPDP, on 1 June 2022, the complaint was found to be
admissible. The following parties were constituted: the complainant – and
the defendant – “IP Telecom Bulgaria” Ltd. A public hearing has been scheduled for 13 July
2022 at 13.00.
The parties, that had been duly notified, were not present, nor have they been
represented.
Taking into consideration the evidence gathered, , and
– Members of the Boards of the Bulgarian SA, establish that the complaint is
justified.
The subject matter of the complaint are allegations against a company, related to failure
to comply with the legal timeframes for the application of Article 15 of the GDPR. The
complaint was lodged by a natural person, having a legal interest, against a company passively
legitimated party – “IP Telecom Bulgaria” Ltd, being the data controller and the recipient of
the request for access pursuant to Article 15 of the GDPR.
The data controller is an electronic communications services (ECS) provider, within the
meaning of § 1, item 17 of the Supplementary Provisions of the Electronic Communications
Act (ECA). As such, “IP Telecom Bulgaria” Ltd. operates the platform for VoIP services
www.zadarma.com , buys and sells telephone numbers from the National Numbering Plan of
the Republic of Bulgaria and other EU Member States.
It is undisputable between the parties, that the company has been processing the
complainant’s personal data since 19 April 2021, because of a registration he had made on the
VoIP services platform www.zadarma.com, for the purposes of purchasing of a product, offered
by the company - a number, for which he paid, but did not receive. The data processed,
related to the data subject is his name ( ), telephone number
( ), email ) and address, which were provided during the
registration on the platform on 19 April 2021. In addition, the company processed data, related
to his nationality, place of residence, as well as data from his driver's license and passport, that
5
he provided again on 20 April 2020, when communicating with an employee of the company
in order to clarify the reason for the refusal for the requested service.
It is undisputable that the complainant’s data processed by the company is personal data,
as the complainant could be directly identified.
It is established that on 20 April 2021, at 14:32, the complainant exercised his right of
access to personal data by sending a letter from his email ) to the email,
indicated for communicating with the company ([email protected]). It became apparent,
that it is a request for access to personal data, pursuant to Article 15 of the GDPR, a fact that
is explicitly stated in the letter itself. The recipient of the request is “IP Telecom Bulgaria”
Ltd, a data controller and an obliged entity within the meaning of the GDPR. The right of
access was exercised in compliance with the instructions of the data controller, namely: at the
address explicitly indicated by the company for the exercising of rights
([email protected]), and by following the instructions given from an employee. Taking
the latter into account, and as supported by evidence (the extract of the conversation in the
virtual chat room between the data subjects and an employee of the company), provided by
“IP Telecom Bulgaria” Ltd. at 15:44, the complainant made a request for access to personal
data and, to be more precise – a copy of all his personal data processed, also explicitly referring
to Article 15 of the GDPR, the text of which he quoted. At 16:21 on the same day, in the
virtual chat room, the data subject explicitly stated again: “I would like to submit an access
request pursuant Article 15 of the General Data Protection Regulation (GDPR) for a copy of
any information that you hold about me, either on computer or in handwritten form, in relation
to my account, documents that I have sent for identification, including chat logs and email
logs relating to process of creating an account and identification.” In response, he was
informed by an employee of the company that he should submit his request to
[email protected].
The actions taken by the complainant are evidence of a request for access to personal
data, duly exercised on 20 April 2021, addressed to “IP Telecom Bulgaria” Ltd – the data
controller. It is undisputed, however, that the controller did not respond to the access request
within the legal time frame under Article 12(3), in connection to para. 4 of the GDPR.
Moreover, there is no response to the access request made once again one month later (20
May 2021), pursuant Article 15 of the GDPR and submitted to [email protected] , which
leads to the conclusion that the controller has violated the provisions, stated above. The
circumstances claimed by the company that the reason for the lack of response was the
possibility that “the emails in question had been forwarded to the spam folder” cannot remedy
the infringement. The controller is obliged pursuant of the Recital 59 GDPR to provide
6
modalities for facilitating the exercise of the data subjects' rights under the Regulation and to
take the necessary measures to provide any information under Articles 13 and 14 and any
communication under Articles 15 to 22 (Article 12(1) GDPR). In this case, the complainant
complied with the modalities provided by the controller for the exercise of the rights of the
data subjects, thus it has to be assumed that the controller is obliged pursuant Article 12(3) of
the GDPR, as of 20 April 2021, to provide the data subject with the requested information by
20 May 2021 or to extend the deadline with another two months, for which to inform him.
The actions taken at a later stage, namely the reply sent to the complainant on 13 January
2022, after administrative proceedings have been initiated before the Bulgarian SA, satisfy
the requirement of the GDPR in terms of the volume of information provided which is due,
but cannot remedy the violation committed - the failure to act within the legal timeframe.
In view of the actions taken by the controller to comply with the data subject's request
and insofar as the infringement does not concern a personal data processing operation, the
Commission considers that measures under Article 58(2)(a), (b), (c), (d), (e), (g), (h) and (j)
of the GDPR are not applicable. In this respect, the CPDP considers that the measure
envisaged in Article 58(2)(i) of the GDPR, namely imposing an administrative fine to the
controller, is appropriate, effective and proportionate to the infringement committed. In
determining the amount of the administrative fine, the following circumstances are considered
mitigating: the Bulgarian SA has not exercised any corrective powers, regarding “IP Telecom
Bulgaria” Ltd.; the controller has cooperated with the Commission in the course of clarifying
the facts and circumstances, related to the case; the controller took action, although not
complying with the legal timeframes, in order to respond to the data subject’s access request;
the controller implemented additional measures in order to upgrade the platform, introducing
additional mechanisms to upgrade the platform by introducing a field for direct
communication with the data subjects. The conditions, referred to in Article 83(2)(b) and (j)
of the GDPR are irrelevant, as the controller in question is a legal entity, that cannot incur
fault, and by the time of the infringement, it did not adhere to approved codes of conduct or
approved certification mechanisms.
The duration, the fact that the data subject had to submit his access request twice and
the fact that the infringement has become known to the Bulgarian SA, after the data subject
submitted a complaint, are qualified as aggravating circumstances.
For the aforementioned reasons and, the fact that it has been established that the data
controller is a micro-enterprise, within the meaning of the Medium and Small Enterprises Act,
the Bulgarian SA considers that, taking into account the principle of proportionality between
the gravity of the infringement and the amount of the administrative fine, the sanction imposed
7
on “IP Telecom Bulgaria” Ltd. Should be 1000 BGN – an amount well below the average
defined in the GDPR for an infringement such as this.
Taking into account the purpose of the sanction, which should have a dissuasive and
preventive effect, the nature and gravity of the infringement, the social relations that it affects,
the CPDP considers that the type and the amount of the administrative fine imposed
undoubtedly meet the effectiveness and dissuasive effect sought by Regulation (EU)
2016/679, while at the same time without violating the principle and the requirement of
proportionality.
For the reasons stated above, the CPDP adopts the following decision:
1. Declares complaint № ПАИКД-01-56/09.12.2021 г. to be justified.
2. Pursuant to Article 83(5)(b) of Regulation (EU) 2016/679, imposes an
administrative fine in the amount of 1000 BGN (€510) on the data controller “IP
Telecom Bulgaria” Ltd. with national registration number: 201274344, for
violation of Article 12(3) of the Regulation.
The Decision of the Commission for Personal Data Protection could be appealed before
the Sofia City Administrative Court within 14 (fourteen) days after receipt.
MEMBERS OF THE BOARD: /s/
/s/
/s/
8