¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
44. A new regulation 50e, which was added in December 2021 and came into force in September 2022, provides for the creation of a data record in the European Criminal Records Information System on Third-Country Nationals (ECRIS-TCN)[4] in relation to any person who has been criminally convicted or given a substitute administrative penalty in Bulgaria and is (a) a national of a State which is not a member State of the European Union (EU), (b) a national of both an EU member State and a non-member State, or (c) a stateless person or a person whose nationality is unknown. Such data records must be created even for convictions pre-dating the start of data entry into the ECRIS-TCN (regulation 50e(4)).
45. In accordance with regulation 50f(1) and (2), also added in December 2021 and in force since September 2022, read in conjunction with regulations 24(1) and 31(1), such a data record must be deleted when the time-limit for the destruction of the respective conviction record card has expired (one hundred years after the birth of the people concerned - see paragraph 37 above), or when the time-limit for the destruction of the respective record card for a substitute administrative penalty has expired (fifteen years after the judgment imposing the penalty has become final - see paragraph 38 above).[5]
46. Under regulations 4(1) and 33, a district court's criminal records bureau can disclose someone's criminal record in one of two ways.[6]
(a) By issuing a conviction certificate (свидетелство за съдимост) following a request by the person to whom the criminal record relates or by certain relatives of that person (regulation 33(2)-(4)). Since September 2022 it has also been possible for some authorities to obtain such certificates directly, in electronic form (електронно свидетелство за съдимост), when by law they have to check someone's criminal record (new regulation 35b, in force since September 2022).
(b) By issuing a criminal record report (справка за съдимост). Such a report can only be sought for official purposes by the authorities empowered to do so (regulation 33(5)). Those authorities are
(i) the criminal courts, prosecutor's offices and investigating authorities (regulation 33(5)(1));
(ii) the various security services tasked with vetting people for the purpose of giving them clearance to access classified information (regulation 33(5)(2));
(iii) other State authorities or bodies authorised by law to obtain such data (regulation 33(5)(3));
(iv) foreign judicial authorities, if that is prescribed by a treaty or by EU law (regulation 33(5)(4));
(v) the central criminal record authorities of other EU member States (regulation 33(5)(5));
(vi) foreign diplomatic or consular missions, in respect of nationals of their own States (regulation 33(5)(6));
(vii) (since an October 2015 amendment) the Central Electoral Commission, in respect of parliamentary candidates for the Bulgarian Parliament and the European Parliament, and candidates for President and Vice-President of the Republic, municipal councillors and mayors (regulation 33(5)(7)); and
(viii) foreign diplomatic or consular missions, in respect of Bulgarian nationals, when necessary for official purposes (regulation 46(2)).
47. A conviction certificate only contains data about convictions (regulation 39(1)). It must moreover not mention any convictions for offences in respect of which the person concerned has been rehabilitated (is no longer considered to have been convicted) (regulation 39(2)(2)), unless a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, but in that case the certificate must specifically mention that the person concerned has been rehabilitated and set out the date when he or she was considered to have been rehabilitated (regulation 39(3)).
48. A criminal record report contains data about both convictions and substitute administrative penalties (regulation 40(1)). It must mention all convictions, irrespective of rehabilitation (regulation 36(2)).
49. As noted in the explanatory notes to the government bill which led to its enactment (no. 102-01-7), the Protection of Personal Data Act 2002 ("the 2002 Act") was enacted in anticipation of the ratification by Bulgaria of the Council of Europe's 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (see paragraph 77 below).
50. Bulgaria had signed that Convention in 1998 and ratified it in 2002, and it came into force with respect to Bulgaria on 1 January 2003. The Convention's translation into Bulgarian was published in the Bulgarian State Gazette on 21 March 2003 (ДВ, бр. 26 от 21.03.2003 г., стр. 58-63). It is accordingly part of Bulgarian domestic law and takes precedence over any conflicting provisions of domestic legislation (Article 5 § 4 of the 1991 Constitution).
51. In November 2006 section 1(3) of the 2002 Act was amended to specify that the Act would apply to all processing of personal data by automatic means, and to all processing otherwise than by automatic means of personal data which formed part of a filing system or were intended to form part of a filing system.
52. The explanatory notes to the government bill (no. 602-01-83) which led to that amendment stated that all proposed amendments were required to bring the 2002 Act fully in line[7] with EU data protection law, particularly as regards the scope of application of the Act, in view of Bulgaria's impending accession to the EU (which took place on 1 January 2007). The text of section 1(3) of the Act, as amended at that time, reflected nearly verbatim the text of Article 3 § 1 of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which was still in force at that time.
53. Article 8 § 5 of Directive 95/46/EC governed specifically the processing of data relating to, inter alia, "offences" and "criminal convictions".
54. With the same 2006 amendment, section 1(5) of the 2002 Act was amended to provide that, unless otherwise stipulated in special legislation, the Act would also apply to the processing of personal data for the purposes of, inter alia, criminal proceedings. Section 1(4) of the 2002 Act, as worded before the amendment, excluded the processing of personal data for the purposes of criminal proceedings from the scope of application of the Act.
55. In October 2011 section 1(5) of the 2002 Act was amended further (along with a number of other provisions of the Act) to specify that unless otherwise provided in special legislation, the Act would apply to the processing of personal data for the purposes of, inter alia, (a) safeguarding public order and combating crime, (b) criminal proceedings, and (c) the execution of criminal penalties. Paragraph 15 of the amending Act specified that the amendments transposed Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, which was still in force at that time.
56. Under section 2(2) of the 2002 Act, as worded after a December 2005 amendment, personal data had to be, inter alia,
(a) processed lawfully and fairly (subsection 2(2)(1));
(b) collected for specified, clearly defined and lawful purposes, and not processed additionally in a manner incompatible with those purposes (subsection 2(2)(2)); and
(c) kept in a form which permitted identification of the respective natural persons for a period no longer than necessary, for the purposes for which those data were processed (subsection 2(2)(6)).
57. The explanatory notes to the government bill (no. 502-01-28) which led to the December 2005 amendments stated that those were necessary to bring the 2002 Act fully in line with EU data protection law, in view of Bulgaria's impending accession to the EU. The wording of section 2(2) of the Act reflected nearly verbatim the wording of Article 6 § 1 of Directive 95/46/EC (see paragraph 49 above).[8]
58. While the proceedings relating to the data about the applicant's penalty were taking place before the Commission for the Protection of Personal Data and then the administrative courts (see paragraphs 18-27 above), and until March 2019, section 38(1) of the 2002 Act provided that anyone could complain to that Commission of a breach of his or her rights under the Act. The Commission's powers in such proceedings were to (a) give directions to the data controller, (b) fix a time-limit for the breach to be put right, and (c) impose an administrative penalty (section 38(2), as worded until March 2019). In cases concerning the processing of personal data for the purposes of national defence, national security, public order or criminal proceedings, the Commission's powers were limited to declaring whether the processing was lawful (section 38(5), currently section 38(6)). The Supreme Administrative Court has held that in such cases, the Commission cannot prescribe any remedial measures, and a case is to be referred back to the relevant authority for it to decide how to proceed, on the basis of the Commission's findings (see реш. № 13202 от 03.12.2008 г. по адм. д. № 10153/2008 г., ВАС, петчл. с-в). At the material time, section 38 of the 2002 Act also provided that the Commission's decision was amenable to judicial review (section 38(6), currently section 38(7)).
59. Alternatively, aggrieved individuals could seek judicial review of the data controller's decisions or actions, plus damages (section 39(1) and (2), as worded until March 2019). If the person concerned had turned to the Commission for the Protection of Personal Data, that remedial avenue could not be used until the proceedings before the Commission (and any proceedings for judicial review of its decision) had ended (section 39(4), as worded until March 2019).
- Provisions as they have been since the entry into force of the General Data Protection Regulation in May 2018 and the transposition of Directive (EU) 2016/680 into Bulgarian law in March 2019
60. In accordance with Article 99 § 2 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation - "the GDPR"), which is directly applicable in all EU member States, the GDPR applies from 25 May 2018. It repealed Directive 95/46/EC (see paragraph 52 in fine above) with effect from the same date (Article 94 § 1 of the GDPR).
61. The GDPR was adopted alongside a more specific EU legal instrument which governs the processing of personal data by the authorities for law-enforcement purposes - Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data ("the Law-Enforcement Directive" - "the LED"). In accordance with Article 63 § 1 of the LED, the Directive was to be transposed by 6 May 2018, and in accordance with Article 59 § 1, it repealed Framework Decision 2008/977/JHA with effect from the same date (see paragraph 55 in fine above).
62. Bulgaria transposed the LED, chiefly by way of amendments to the 2002 Act which came into force in March 2019. Those amendments also brought the 2002 Act in line with the GDPR.
63. In accordance with Article 2 § 2 (d) of the GDPR, the regulation does not apply to the processing of personal data "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security". As explained in recital 19 of the GDPR, that sort of processing is instead governed by the LED (see judgment of the Court of Justice of the European Union (CJEU) of 22 June 2021 in Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 69). Under Article 2 § 1 read in conjunction with Article 1 § 1 of the LED, the processing of personal data by competent authorities for all those purposes accordingly falls within the LED's scope of application. "Competent authority" is defined in Article 3 § 7 of the LED, and the same definition is applied to Article 2 § 2 (d) of the GDPR (ibid.).
64. Article 1 § 1 and Article 2 § 1 of the LED were transposed by section 1(2) of the 2002 Act, as amended with effect from March 2019.
65. Recital 19 in fine of the GDPR and recital 11 of the LED specify that if a law-enforcement authority or a court processes personal data for purposes other than the law-enforcement purposes covered by the LED, that sort of processing is governed by the GDPR.
66. For instance, as made plain by Article 10 of the GDPR (which superseded Article 8 § 5 of Directive 95/46/EC - see paragraph 53 above and paragraph 70 below; see also judgment of the CJEU of 24 September 2019 in GC and Others (De-referencing of sensitive data), C-136/17, EU:C:2019:773, paragraph 41), the regulation applies to the processing of personal data relating to criminal convictions and offences.
(a) Processing falling within the scope of the GDPR
67. The amendments to the 2002 Act transposing the LED and bringing Bulgarian law in line with the GDPR (see paragraph 62 above) repealed section 2(2) of the Act (see paragraph 56 above), since in so far as the processing of personal data falling within the scope of the GDPR is concerned, the Act now only governs matters not addressed by the GDPR itself (section 1(1) of the Act, as amended in early 2019).
68. The principles relating to the processing of personal data in Bulgaria falling within the scope of the GDPR are thus now those set out in Article 5 §§ 1 and 2 of the GDPR itself. In accordance with that provision, those include the requirements that personal data be
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency" - Article 5 § 1 (a));
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes ("purpose limitation" - Article 5 § 1 (b)); and
(c) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ("storage limitation" - Article 5 § 1 (e)).
69. The CJEU has clarified that the principles set out in that Article also apply to the processing of personal data relating to criminal convictions and offences (see Latvijas Republikas Saeima (Penalty points), cited in paragraph 63 above, paragraphs 96 and 104 in fine). It has also noted that those principles apply cumulatively, and that any such processing must therefore comply with all of them (see judgment of the CJEU of 20 October 2022 in Digi, C-77/21, EU:C:2022:805, paragraph 47).
(b) Processing of criminal record data falling within the scope of the GDPR
70. Article 10 of the GDPR requires, inter alia, that the "processing of personal data relating to criminal convictions and offences ... be carried out only under the control of official authority or when the processing is authorised by EU or member-State law providing for appropriate safeguards for the rights and freedoms of data subjects".
71. The CJEU has noted that this provision is intended to ensure enhanced protection in respect of processing which, owing to the particular sensitivity of the data at issue, which can lead to social disapproval and stigmatise the data subject, can amount to a particularly serious interference with the right to respect for private life (see Latvijas Republikas Saeima (Penalty points), cited in paragraph 63 above, paragraphs 74-75).
72. The CJEU has also clarified that although this provision applies only to data relating to "criminal offences", not administrative sanctions, the autonomous meaning of that term also covers road traffic offences, even when they are classified as administrative in the national law of the State concerned (ibid., paragraphs 77-93).
(c) Processing falling within the scope of the LED
73. The processing of personal data for purposes falling under the LED is governed by section 45(1) of the 2002 Act, as amended in early 2019, which transposed Article 4 § 1 of the LED. That provision requires that personal data be, inter alia,
(a) processed lawfully and fairly (section 45(1)(1) - see also, on this point, Article 4 § 1 (a) of the LED and its recital 26);
(b) collected for specified, explicit and lawful purposes and not processed in a manner that is incompatible with those purposes (section 45(1)(2) - see also, on this point, Article 4 § 1 (b) of the LED and its recital 29); and
(c) kept in a form which permits identification of the data subject for a period no longer than necessary for the purposes for which they are processed (section 45(1)(5) - see also, on this point, Article 4 § 1 (e) of the LED and its recital 26 in fine, as well as judgment of the CJEU of 30 January 2024 in Direktor na Glavna direktsia "Natsionalna politsia" pri MVR-Sofia, C-118/22, EU:C:2024:97, paragraphs 43, 45 and 60 in fine).
74. Section 46(1) of the 2002 Act, as amended in early 2019, which transposed Article 5 of the LED (see also recital 26 in fine of the LED, and Direktor na Glavna direktsia "Natsionalna politsia" pri MVR-Sofia, cited in paragraph 73 (c) above, paragraphs 44, 68 and 70), provides that when the time-limits for the deletion of personal data or for a periodic review of the need for their storage have not been fixed by law or regulation, they must be fixed by the data controller. Section 46(2) goes on to specify that any such periodic review has to be documented, and that reasons have to be given for any decision to keep storing the data.
75. In March 2019, when the 2002 Act was brought in line with the GDPR and the LED, the earlier system of remedies (see paragraphs 58-59 above) was kept, except with respect to data processing by the courts and the prosecuting and investigating authorities for law-enforcement purposes. The only change was that the powers of the Commission for the Protection of Personal Data were harmonised with Article 58 § 2 (a)-(h) and (j) of the GDPR (sections 38(3) and 82(1) of the Act, as worded since March 2019).
76. Since March 2019 the administrative remedy in respect of data processing by the authorities for law-enforcement purposes has been a complaint to the Inspectorate attached to the Supreme Judicial Council (sections 38b(1) and 82(1), as worded since March 2019). The judicial remedy remains a claim for judicial review of the data controller's or data processor's decisions or actions, possibly coupled with a claim for damages (sections 39(1) and (2) and 82(1), as worded since March 2019). The bar on parallel proceedings before the Commission for the Protection of Personal Data or the Inspectorate (and any proceedings for judicial review of their decisions) and judicial review proceedings against the data controller remained (section 39(4) and (5), as worded since March 2019).
RELEVANT COUNCIL OF EUROPE MATERIAL
77. In accordance with Article 5 (e) of the Council of Europe's 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108; 1496 UNTS 65), personal data undergoing automatic processing have to be "preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored".
78. According to data published by the National Statistical Institute,[9] 3,273 people were given substitute administrative penalties under Article 78a of the Criminal Code (see paragraph 29 above) in 2022.
79. According to data published by the Ministry of Internal Affairs in January 2015,[10] about 41,000 people were occupying civil-servant posts in that Ministry in December 2014.
80. The applicant complained under Article 8 of the Convention about the retention of the data related to his substitute administrative penalty and the actual and potential disclosure of those data. That provision reads, so far as relevant:
"1. Everyone has the right to respect for his private ... life ...
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
81. The applicant applied to the Court in August 2015 following data about his substitute administrative penalty actually being disclosed. However, a thorough reading of his application and his observations filed in June 2023 shows that, though chiefly aggrieved by the actual disclosure of those data in 2012-13 (which had resulted in his dismissal), he was also aggrieved by the (alleged) ongoing retention of those data, and that his complaint under Article 8 of the Convention relates to both grievances. That (alleged) ongoing retention is hence within the scope of the case that he referred to the Court in the exercise of his right of individual application (compare, mutatis mutandis, S.M. v. Croatia [GC], no. 60561/14, § 225, 25 June 2020, and Yüksel Yalçınkaya v. Türkiye [GC], no. 15669/20, §§ 279-80, 26 September 2023, and contrast, mutatis mutandis, Radomilja and Others v. Croatia [GC], nos. 37685/10 and 22768/12, §§ 128-30, 20 March 2018, and NIT S.R.L. v. the Republic of Moldova [GC], no. 28470/12, §§ 144-45, 5 April 2022).
(i) Exhaustion of domestic remedies
82. The Government submitted that the proceedings for judicial review of the applicant's dismissal had concerned his employment, and had not been a remedy in respect of the retention of data about his penalty. The courts hearing that case had clearly differentiated between the lawfulness of the dismissal and any issues relating to the applicant's criminal record. The remedy in respect of the retention of the data in issue had instead been the proceedings before the Commission for the Protection of Personal Data. Although that case had reached the Supreme Administrative Court, the applicant had, for unclear reasons, withdrawn his complaint to the Commission, thus retrospectively invalidating its decision, and subsequently had not taken part in the proceedings for judicial review of that decision. He had thus failed to pursue his grievance all the way up through the appropriate domestic legal channels, and hence to exhaust domestic remedies.
83. The applicant pointed out that although he had withdrawn his complaint to the Commission for the Protection of Personal Data, the Supreme Administrative Court had examined the case on the merits and had analysed the arguments which he had put before the Commission. The withdrawal of his complaint could not therefore be seen as a failure to exhaust domestic remedies. All that was in any event irrelevant, since those proceedings had not been a remedy in respect of his complaint under Article 8 of the Convention; the real remedy in respect of that complaint had been the proceedings for judicial review of his dismissal.
(ii) Compliance with the six-month time-limit
84. The Government submitted that the judgment in which the Supreme Administrative Court had upheld the applicant's dismissal with final effect had not been the "final decision" in respect of the complaint which he had then raised before the Court. Those proceedings had concerned the applicant's employment, not the retention of the data about his penalty. The remedy in respect of that retention had been the proceedings before the Commission for the Protection of Personal Data, which had ended more than six months before the applicant had applied to the Court.
85. The applicant submitted that the subject matter of the proceedings in which he had challenged his dismissal had been inextricably linked to the complaint that he had then raised before the Court. That dismissal had resulted solely from the unjustified retention and disclosure of the data about his penalty. The outcome of those proceedings had thus been important as regards the extent of the damage flowing from the alleged breach of Article 8 of the Convention, and it had been necessary to await that outcome to ascertain the magnitude of the breach before turning to the Court. Moreover, when ruling on his dismissal, the Supreme Administrative Court had independently analysed the lawfulness of retaining the data about the penalty, without deferring to its earlier findings in the case concerning the retention itself. It followed that the only proceedings capable of effectively protecting the applicant's rights under Article 8 had been those in which he had challenged his dismissal, and that the "final decision" had been the one given by the Supreme Administrative Court in that case.
86. On the facts of this case, the questions of whether domestic remedies have been exhausted and whether the six-month time-limit (applicable prior to the entry into force of Protocol No. 15 to the Convention on 1 August 2021, which reduced it to four months) has been complied with are inextricably linked, and must be examined together.
87. Indeed, those two requirements are in general closely intertwined (see, among other authorities, Jeronovičs v. Latvia [GC], no. 44898/10, § 75, 5 July 2016). Not only do they feature in the same provision, but they are set out in a single sentence whose grammatical construction implies such a correlation (see, among other authorities, Lopes de Sousa Fernandes v. Portugal [GC], no. 56080/13, § 130, 19 December 2017; Savickis and Others v. Latvia [GC], no. 49270/11, § 131, 9 June 2022; and Ukraine and the Netherlands v. Russia (dec.) [GC], nos. 8019/16 and 2 others, § 776, 30 November 2022). Accordingly, the time-limit under Article 35 § 1 normally starts to run from the "final decision" resulting from the exhaustion of remedies capable of adequately and effectively redressing the matter complained of (see, among other authorities, Nikolova and Velichkova v. Bulgaria (dec.), no. 7888/03, 13 March 2007; Dzhabarov and Others v. Bulgaria, nos. 6095/11 and 2 others, § 57, 31 March 2016; D.H. and Others v. North Macedonia, no. 44033/17, § 28, 18 July 2023; and Dragan Petrović v. Serbia, no. 75229/10, § 50, 14 April 2020).
88. In the present case, compliance with those two admissibility criteria needs to be assessed separately with respect to (a) the actual disclosure in 2012-13 of the data about the applicant's penalty to the authority which was employing him (see paragraphs 9-11 above), and (b) the (alleged) ongoing retention of those data and the resulting risk of the data being disclosed (see D.S. v. the United Kingdom, no. 70988/12, §§ 22-23, 30 March 2021, and M.C. v. the United Kingdom, no. 51220/13, § 36-38, 30 March 2021, and, mutatis mutandis, L.B. v. Hungary [GC], no. 36345/16, § 58, 9 March 2023). The former consisted of one-off acts, whereas the latter amounts to a continuing situation (see Hilton v. the United Kingdom, no. 12015/86, Commission decision of 6 July 1988, Decisions and Reports (DR) 57, p. 108, at p. 114, and M.M. v. the United Kingdom, no. 24029/07, §§ 160 and 172, 13 November 2012). An examination of the application form shows that the applicant complained not only of the actual disclosure, but also of the ongoing retention of those data (see paragraph 81 above, and contrast Aramov v. Bulgaria (dec.), no. 28649/03, 12 June 2012).
89. The proceedings in which the applicant challenged his dismissal (see paragraphs 12-15 above) were not a remedy in respect of the data retention and disclosure which led to that dismissal, and cannot be taken into account when assessing exhaustion or compliance with the six-month time-limit in respect of the applicant's complaint about that data retention and disclosure (see, mutatis mutandis, M.C. v. the United Kingdom, cited above, § 37). It is true that in those proceedings he put forward arguments about the lawfulness of retaining the data, and that the courts engaged with those arguments. It nonetheless remains the case that the proceedings did not challenge the retention or disclosure of the data as such, and could not result in any redress relating to the data themselves; the aim of the proceedings was purely to protect the applicant's job. They were hence not a remedy in respect of the complaint under Article 8 of the Convention which the applicant then raised before the Court (see Leander v. Sweden, no. 9248/81, Commission decision of 10 October 1983, DR 34, p. 78, at p. 85 in fine, and M.M. v. the United Kingdom, cited above, § 161). A remedy relating to retained data is normally effective only if it can lead to their deletion or rectification (see Kamburov v. Bulgaria (dec.), no. 14336/05, § 56, 6 June 2006) or at least, in some circumstances, to a situation where such data cannot be disclosed (see M.M. v. the United Kingdom, cited above, § 159, and A.S. v. the United Kingdom (dec.), no. 22189/10, 11 March 2014).
90. By contrast, the proceedings resulting from the applicant's complaint to the Commission for the Protection of Personal Data (see paragraphs 18-27 above) can be seen as a remedy which could redress his grievance in relation to the disclosure of the data. In such proceedings, the Commission could give directions to the data controller, fix a time-limit for the breach to be put right, and impose an administrative penalty (see paragraph 58 above). In the proceedings brought by the applicant, the Commission found that the retention of the data after October 2009 and their resulting disclosure had been unlawful, and fined the Troyan District Court for those two breaches of the relevant data protection requirements (see paragraph 21 above).
91. The question is whether the applicant duly exhausted that remedy. It cannot be overlooked that after the Commission had given its decision in respect of his complaint and the respondent authority (the Troyan District Court) had sought judicial review of that decision, the applicant - who was party to those judicial review proceedings (see paragraph 23 above) - withdrew his complaint to the Commission, thus causing the Sofia City Administrative Court to declare the Commission's decision null and void on the basis that the withdrawal of the complaint had retrospectively deprived the Commission of its competence to give a decision in that regard (see paragraphs 22-25 above). However, when the case then came before the Supreme Administrative Court following an appeal by the Commission itself (the applicant chose not to take part in those proceedings), that court went on to analyse the merits of the case and to hold that the data in question had not been processed unlawfully, since the electronic version of the data was to be kept indefinitely (see paragraphs 26-27 above). Indeed, that court maintained that position in all of its subsequent judgments dealing with the point (see paragraph 43 above). Nothing suggests that the Supreme Administrative Court would have ruled otherwise if the applicant had taken part in the proceedings before it.
92. In those circumstances, the complaint cannot be rejected for failure to exhaust domestic remedies. Non-exhaustion of domestic remedies cannot be held against an applicant if, despite his or her failure to bring the case before the competent national court in line with the relevant procedural requirements, that court has examined the substance of his or her complaint (see, among other authorities, Öztürk v. Turkey [GC], no. 22479/93, §§ 45-46, ECHR 1999-VI; Gäfgen v. Germany [GC], no. 22978/05, § 143, ECHR 2010; and Savickis and Others, cited above, §§ 140 and 152).
93. However, the other consequence of the above analysis is that the "final decision" in respect of the applicant's complaint concerning the actual disclosure of the data about his penalty was the judgment given by the Supreme Administrative Court on 27 November 2014. Since the applicant lodged his application with the Court on 10 August 2015, more than eight months after that judgment, this complaint must be rejected for failure to comply with the six-month time-limit under Article 35 § 1 of the Convention.
(ii) Alleged ongoing retention and ensuing risk of disclosure
94. Although the applicant did not direct his complaint made to the Commission for the Protection of Personal Data against the Troyan District Court, where the record card for his substitute administrative penalty had been kept, it can be accepted that this complaint also concerned the ongoing retention of the data about that penalty (see paragraph 18 above). It is also true that he then retrospectively withdrew that complaint and took no part in the judicial review proceedings in which the Commission's decision was challenged by the Troyan District Court (see paragraphs 22-27 above). Nor did he try the alternative remedy - seeking judicial review of the data controller's actions and possibly damages (see paragraph 59 above). However, in the light of the Supreme Administrative Court's ruling, in the proceedings against the Commission's decision, that the processing of data about the applicant's penalty was lawful - a position which that court fully maintained in all of its subsequent judgments on the point (see paragraphs 27 and 43 above) - it would have been futile for the applicant to pursue the first of those remedies to conclusion or attempt the second. It follows that in so far as his complaint concerns the alleged ongoing retention of the data about his penalty, it cannot be rejected for failure to exhaust domestic remedies. Applicants do not have to pursue remedies which do not offer a reasonable prospect of success (see, as a recent authority, Communauté genevoise d'action syndicale (CGAS) v. Switzerland [GC], no. 21881/20, §§ 139 and 141, 27 November 2023). A consistent line of adverse rulings by the highest court on a point of law is normally evidence of the absence of such a prospect (see Posevini v. Bulgaria, no. 63638/14, § 54 in fine, 19 January 2017, with further references, and contrast, mutatis mutandis, Dimcho Dimov v. Bulgaria (no. 2), no. 77248/12, § 75, 29 June 2017).
95. As regards compliance with the six-month time-limit, the ongoing retention of the data about the applicant's penalty amounts to a continuing situation, as noted in paragraph 88 above. The same goes for the ensuing risk of those data being disclosed. That situation allegedly still obtained when the applicant lodged his application with the Court on 10 August 2015, and indeed allegedly persists to this day. This part of the complaint cannot therefore be rejected for failure to comply with the six-month time-limit under Article 35 § 1 of the Convention (see Hilton, cited above, at p. 114).
96. The Government submitted that the applicant was no longer a victim, for two reasons. First, a criminal record report about him issued by the Troyan District Court in November 2022 at the Government's request had contained no entries. Secondly, he had been able to obtain public-sector employment almost immediately after his dismissal from his post as a prison guard had been upheld with final effect (see paragraph 28 above). That dismissal had thus not harmed his career.
97. With regard to the Government's first point, the applicant queried whether the data about his penalty had indeed been fully deleted, in view of the Government's assertion elsewhere in their observations that those data were to be kept indefinitely - a position which found some support in the domestic rules on the point. The removal of the data from one place did not mean that they had been fully deleted. As for the Government's second point, the applicant noted that after his dismissal he had been on unemployment benefits lower than his salary for nine months, and had then remained unemployed and without income for a further fourteen months. The salary for the job which he had started in August 2015 (see paragraph 28 above) had been lower than that which he would have received as a prison guard. Moreover, if he had not been dismissed from that post on grounds of incompatibility, but for other reasons, he would also have received severance pay.
98. The Court is not concerned with whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention in respect of his dismissal from work: he did not complain to it about that dismissal as such. The scope of the case referred to the Court in the exercise of the right of individual application is determined by the applicant's complaint (see Radomilja and Others, cited above, § 126). It follows that the Court has no jurisdiction to deal with the applicant's dismissal, and accordingly to examine whether he can still claim to be a victim in respect of that (see, mutatis mutandis, Handzhiyski v. Bulgaria, no. 10783/14, § 31 in fine, 6 April 2021, and Paketova and Others v. Bulgaria, nos. 17808/19 and 36972/19, § 125 in fine, 4 October 2022).
99. Nor is the Court concerned with whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention in respect of the actual disclosure in 2012-13 of the data about his penalty to the authority which was employing him. It has already been established that his complaint in respect of that actual disclosure is inadmissible because it was raised after the expiry of the six-month time-limit under Article 35 § 1 of the Convention (see paragraph 93 above, and compare, mutatis mutandis, Benedik v. Slovenia, no. 62357/14, § 77, 24 April 2018).
100. It follows that the only matter in relation to which it must be ascertained whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention is the ongoing retention and potential disclosure of the data about his substitute administrative penalty.
101. Neither of the two circumstances pleaded by the Government can deprive the applicant of his status as a victim in respect of that matter.
102. Although the record card for the applicant's penalty was destroyed in 2012 (see paragraph 17 above), it is open to question whether, as claimed by him, the electronic version of the data from that card is still being retained. Although they submitted a copy of a criminal record report issued in November 2022 which did not reflect those data (see paragraph 96 above), the Government did not expressly confirm that the data themselves had been deleted (compare, mutatis mutandis, the circumstances in Uçkan v. Türkiye [Committee], no. 67657/17, § 19, 18 April 2023). Moreover, the applicant's assertion is confirmed by the Government's insistence elsewhere in their observations that according to a proper interpretation of the relevant regulations, those data are not subject to deletion (see paragraph 128 below). That position fully matches the position consistently expressed at domestic level by the Ministry of Justice, which drafted those regulations, and by the Supreme Administrative Court - that electronic data about substitute administrative penalties are to be kept indefinitely (see paragraphs 19, 27 and 42-43 above). Indeed, in its oral submissions before the Commission for the Protection of Personal Data in June 2013, after the destruction of the record card, that Ministry confirmed that the data still existed (see paragraph 20 above). It can hence be accepted that those data are still being retained in some form in the Bulgarian criminal records system. It follows that the applicant may claim to be a victim of a violation of Article 8 of the Convention on account of that ongoing retention (see, mutatis mutandis, Catt v. the United Kingdom, no. 43514/15, § 76, 24 January 2019). For as long as those data are retained and remain capable of being disclosed, he remains a victim of any potential breach of that Article flowing from that (see M.M. v. the United Kingdom, cited above, § 159).
103. The effect which the disclosure of those data could have on the applicant's employment prospects is immaterial in that regard. It is settled that the mere storing by a public authority of data relating to someone's private life amounts to an interference within the meaning of Article 8 § 2 of the Convention, irrespective of whether or how those data are then used (see Amann v. Switzerland [GC], no. 27798/95, § 69, ECHR 2000-II; S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 67 and 121, ECHR 2008; Gardel v. France, no. 16428/05, § 58, ECHR 2009; Khelili, cited above, § 55; Aycaguer v. France, no. 8806/12, § 33, 22 June 2017; and Trajkovski and Chipovski v. North Macedonia, nos. 53205/13 and 63320/13, § 51, 13 February 2020).
104. More generally, the existence or absence of prejudice has no bearing on the question of whether someone can claim to be a victim within the meaning of Article 34 (former Article 25) of the Convention; it is relevant only in the context of Article 41 (former Article 50) of the Convention (see, among other authorities, Marckx v. Belgium, 13 June 1979, § 27 in fine, Series A no. 31; Lüdi v. Switzerland, 15 June 1992, § 34, Series A no. 238; and Peev v. Bulgaria, no. 64209/01, § 55, 26 July 2007 ) and also, since June 2010, in assessing whether an applicant has suffered a significant disadvantage within the meaning of Article 35 § 3 (b) of the Convention, which was inserted by Article 12 of Protocol No. 14.
105. It follows that the applicant can still claim to be a victim of a violation of Article 8 of the Convention, and that the Government's objection in that regard must be dismissed.
106. The Government submitted that despite his subjective perception of how the alleged breach had affected him, the applicant had not suffered a significant disadvantage. They again pointed out that he had later been able to find employment in the public sector, and highlighted his lack of interest in the proceedings relating to the retention of the data about his penalty.
107. The applicant referred to his submissions in relation to his victim status (see paragraph 97 above).
108. The criterion of no significant disadvantage hinges on the idea that a breach of a Convention right, however real from a purely legal point of view, should attain a minimum level of severity to warrant consideration by the Court. The assessment of this minimum is relative and depends on all the circumstances of the case, and the severity of a breach should be gauged taking account of both the applicant's subjective perceptions and what was objectively at stake. However, even if it is found that the applicant has not suffered a significant disadvantage as a result of the matter complained of, the complaint may nonetheless not be declared inadmissible on this ground if respect for human rights, as defined in the Convention and the Protocols thereto, requires an examination on the merits (see, as a recent authority, X and Others v. Ireland, nos. 23851/20 and 24360/20, § 63, 22 June 2023).
(i) "Significant disadvantage"
109. The Court is not concerned with whether the applicant suffered a significant disadvantage owing to the actual disclosure in 2012-13 of the data about his penalty to the authority which was employing him, an act which resulted in his dismissal. It has already found that his complaint in respect of that actual disclosure is inadmissible because it was raised after the expiry of the six-month time-limit under Article 35 § 1 of the Convention (see paragraph 93 above).
110. It follows that the only matters in relation to which the Court must ascertain whether the applicant has suffered a significant disadvantage are (a) the alleged ongoing retention of data about his penalty and (b) the potential disclosure of those data.
111. There is no evidence that the ongoing retention of those data in itself has caused or is causing the applicant any real detriment. In this type of case, a complaint about retention in reality flows not from the retention itself, but from the fact that if data are retained, the disclosure of those data may follow (see M.M. v. the United Kingdom, cited above, § 159).
112. As regards the potential disclosure of those data, an examination of the relevant domestic regulations makes it plain that the only lawful way in which such data can be disclosed is via a criminal record report (see paragraph 48 above). Such reports can be obtained by only a limited number of authorities, mainly in connection with criminal proceedings, vetting procedures for the purpose of giving people clearance to access classified information, international cooperation in criminal matters, or electoral purposes (see paragraph 46 (b) above).
113. The applicant did not express concern about the data relating to his penalty being used in any criminal proceedings against him. It should also be noted in this connection that under Bulgarian law, people who have been given substitute administrative penalties are not regarded as having been convicted of a criminal offence (see paragraph 29 in fine above). Moreover, they can benefit from such a waiver of criminal liability again if more than a year has passed since the execution of any previous substitute administrative penalty (see paragraph 29 above), as has been the case for the applicant since January 2006, one year after he paid his fine (see paragraph 8 above). Nor has the applicant expressed concern about the possible use of those data for security-clearance or electoral purposes.
114. Instead, the applicant's concerns in relation to the data about his penalty relate to the effect that their disclosure could have on his employment prospects. It is clear, however, that under the relevant regulations, those data cannot be obtained by a private employer, or indeed by most public-sector employers. Other than for the purposes outlined above, they can be obtained by only "State authorities or bodies authorised by law to obtain such data" (see paragraph 46 (b) above). Apparently, and this was also illustrated by the applicant's case, in practice, this category consists of State authorities or bodies which need such data to assess (a) whether they can appoint someone to a post which cannot, by law, be occupied by someone who has been given a substitute administrative penalty; or (b) whether they have to dismiss someone already occupying such a post (either because he or she has been appointed owing to an oversight, because his or her penalty has for some reason not come to the attention of the authority employing him or her, or because he or she has been given such a penalty during the course of his or her employment).
115. Until mid-2014 there were many types of public-sector posts in Bulgaria which could not be occupied by people who had received substitute administrative penalties - all of the many thousands of posts in the Ministry of Internal Affairs, and many of the posts in the Chief Directorate for the Execution of Punishments (see paragraphs 30 and 79 above). However, this has not been the case since the Ministry of Internal Affairs Act 2014 came into effect in mid-2014 - contrary to its predecessors, that Act bars only people who have been given a criminal sentence from employment in that Ministry (and thus in the Chief Directorate for the Execution of Punishments) (see paragraphs 30 above). Since mid-2014 a substitute administrative penalty for a wilful offence - as in the applicant's case - bars people from employment in only a limited number of sensitive or high-ranking posts (see paragraph 31 above). There is no indication that the applicant was realistically envisaging applying for any of those posts.
116. It cannot therefore be said that the applicant was tangibly affected by the potential disclosure of the data about his penalty when he lodged his application with the Court in August 2015 and that he has been similarly affected ever since. Indeed, the fact that he retrospectively withdrew his complaint to the Commission for Personal Data Protection and took no part in the proceedings for judicial review of that Commission's decision (see paragraphs 22 and 26 above) also suggests that the ongoing retention of those data has not caused him any particular concern in itself.
117. It follows that the alleged retention of the data about the applicant's penalty and the potential disclosure of those data have not caused him a significant disadvantage within the meaning of Article 35 § 3 (b) of the Convention.
(ii) "Respect for human rights"
118. Respect for human rights nonetheless requires an examination of the merits of a complaint if it raises questions of a general character affecting the observance of the Convention, for instance when there is a need to clarify a State's obligations or to induce it to resolve a structural deficiency (see, as a recent authority, X and Others v. Ireland, cited above, § 65).
119. The complaint under examination raises broader issues with regard to the compatibility of the retention of data about substitute administrative penalties in Bulgaria with Article 8 of the Convention (compare, mutatis mutandis, E.B. and Others v. Austria, nos. 31913/07 and 4 others, §§ 61 in fine and 63, 7 November 2013). It is telling that those issues, which undoubtedly affect thousands of people in Bulgaria who are given such penalties each year (see paragraph 78 above), have caused a long-running controversy between Bulgaria's Personal Data Protection Commission and its Ministry of Justice (see paragraphs 19-21, 24 and 42 above). This suggests that they are of a structural character.
120. Moreover, the application of the relevant data protection rules in Bulgaria to criminal record data appears to throw up novel issues with which the Bulgarian authorities are yet to fully grapple, especially since the overhaul of that branch of Bulgarian law following the entry into force of the GDPR and the transposition of the LED (see, mutatis mutandis, Ekimdzhiev and Others v. Bulgaria, no. 70078/12, § 275, 11 January 2022). The substantive issues raised by the complaint hence deserve consideration by the Court (see, mutatis mutandis, M.N. and Others v. San Marino, no. 28005/12, § 39, 7 July 2015; Margari v. Greece, no. 36705/16, § 23, 20 June 2023; and X and Others v. Ireland, cited above, § 65).
121. It follows that respect for human rights as defined in the Convention and the Protocols thereto requires that this complaint be examined on the merits. The Government's request that it be declared inadmissible with reference to Article 35 § 3 (b) of the Convention must therefore be rejected.
122. As noted in paragraph 93 above, in so far as the applicant complained about the actual disclosure in 2012-13 of the data relating to his substitute administrative penalty, his complaint is out of time and must be rejected under Article 35 §§ 1 and 4 of the Convention.
123. Conversely, in so far as the applicant complained about the ongoing retention and potential disclosure of those data, as found in paragraphs 95, 105 and 121 above, his complaint is not inadmissible on any of the grounds cited by the Government. Nor is this part of the complaint manifestly ill-founded or inadmissible on other grounds. It must therefore be declared admissible.
124. It is settled that (a) the processing of data about criminal convictions and related measures concerns the private life of the people to whom those data relate, and thus attracts the protection of Article 8 of the Convention, and (b) the processing of such data by the authorities amounts to interference with the data subjects' right to respect for their private life (see, as a recent authority, N.F. and Others v. Russia, nos. 3537/15 and 8 others, §§ 34 and 38, 12 September 2023). Indeed, the data contained in a criminal record, though often based on a court judgment delivered in public, are sensitive and may affect the individual concerned, and are hence linked to his or her private life (see E.B. and Others v. Austria, cited above, § 75 in fine; see also, mutatis mutandis, Biancardi v. Italy, no. 77419/16, § 67, 25 November 2021, and Hurbain v. Belgium [GC], no. 57292/16, § 215 in fine, 4 July 2023).
125. The parties were in agreement that the retention of data about the applicant's substitute administrative penalty amounted to interference with his right to respect for his private life under Article 8 of the Convention, and it has already been found in paragraph 102 above that despite the destruction of the record card for that penalty in 2012, the data relating to it are apparently still being retained in some electronic form. As noted in paragraph 103 above, according to the Court's case-law, the mere storing by a public authority of such data amounts to interference with a person's right to respect for his or her private life within the meaning of Article 8 § 2 of the Convention, irrespective of whether or how those data are later used.
126. To be justified under Article 8 § 2 of the Convention, such interference must (a) be "in accordance with the law"; (b) pursue one or more of the legitimate aims set out in that provision; and (c) be "necessary in a democratic society" to attain that aim or those aims.
(a) "In accordance with the law"
127. The applicant submitted that Regulations no. 8 of 2008 contained many points which were unclear. For instance, although regulation 31(1) laid down a time-limit for keeping the record cards for substitute administrative penalties, it said nothing about the retention of the alphabetical index and the incoming register of those cards; the point had not been addressed by any other regulation either. Moreover, the Regulations did not specify what data went into that index and register - data which were to be retained even after the destruction of the cards, according to the Supreme Administrative Court's interpretation of those Regulations. If the index and register were to be seen as secondary, it made no sense to keep the data in them after the destruction of the cards themselves. Otherwise, the destruction of the cards made no sense from a data protection perspective and was merely the dematerialisation of records. The statutes barring people with substitute administrative penalties from some public-sector posts could not clarify this point either. They could not be interpreted as imposing a lifelong ban on such employment, and hence as requiring the indefinite retention of the data about such penalties. The applicant stated that the uncertainties in the Regulations had been illustrated by the inconsistent manner in which they had been applied by the Troyan District Court in his case (see paragraphs 9-10 and 17 above). The Government's position on the electronic data about his penalty was also contradictory: they claimed that those data had been destroyed, but also that they were to be kept indefinitely.
128. In the Government's view, Regulations no. 8 of 2008 were sufficiently clear. The doubt about whether record cards for substitute administrative penalties whose five-year retention period had already expired by the time of the decision in February 2013 to extend it to fifteen years had been promptly resolved by the Supreme Judicial Council's legal affairs committee. As for the retention of the electronic data taken from such record cards, the Supreme Administrative Court had correctly pointed out that those data were to be kept indefinitely; the position of the Commission for the Protection of Personal Data on the point could not be accepted without qualifications. The main justification for keeping those data indefinitely was to enable the vetting of people employed or seeking employment in specific public-sector posts. The Regulations thus had to be read alongside and in the light of the statutory provisions laying down that prohibition, which was absolute.
129. To be "in accordance with the law", an interference must not only have a basis in domestic law; that law must furthermore be accessible and sufficiently foreseeable (see, among many other authorities, N.F. and Others v. Russia, cited above, § 39). With regard specifically to the processing of criminal record data, it is essential to have clear and detailed rules governing the scope and application of such measures, and minimum safeguards concerning, among other things, duration, storage, usage, access of third parties, and the procedures for preserving the integrity and confidentiality of the data and their destruction (see M.M. v. the United Kingdom, § 195, and N.F. and Others v. Russia, § 40, both cited above). At each stage of the processing of such data, appropriate safeguards which reflect the principles set out in the applicable data protection instruments must be in place (see M.M. v. the United Kingdom, cited above, § 195 in fine).
(β) Application of those principles
130. The salient question in this case is whether the regulations governing the ongoing retention of the data about the applicant's substitute administrative penalty are sufficiently foreseeable.
131. Those regulations lay down clear a time-limit (five years up until February 2013, and fifteen years since then) for keeping record cards for substitute administrative penalties (see paragraph 38 above). By contrast, the regulations appear to contain ambiguity on the question of whether the electronic data derived from those cards are to be deleted alongside the record cards themselves, or whether they are to be retained for longer or indeed indefinitely (see paragraphs 38-39 above). With the digitalisation of the relevant records (see paragraph 35 above), this question takes on considerable importance.
132. The Bulgarian Ministry of Justice, which drafted those regulations (see paragraph 32 above), considered that the correct interpretation of the regulations was that they required the indefinite retention of those electronic data (see paragraphs 19, 20, 24 and 42 above). By contrast, the Bulgarian data protection authority, the Commission for the Protection of Personal Data, was firmly of the opposite view - that the regulations, properly construed, required that electronic data derived from the record cards be deleted along with the cards themselves, and that any indefinite retention of personal data was inconsistent with the strictures of Bulgarian data protection law (see paragraphs 21 and 42 above). Since that Commission is a body with special competence and expertise in this domain, its views on the point cannot be discounted lightly (contrast, mutatis mutandis, Ivan Todorov v. Bulgaria, no. 71545/11, § 38, 19 January 2017).
133. Regulations which are vague enough to cause confusion even among the national authorities in charge of their interpretation and application can hardly be seen as sufficiently foreseeable (see, mutatis mutandis, Jėčius v. Lithuania, no. 34578/97, § 59, ECHR 2000-IX; Nasrulloyev v. Russia, no. 656/06, §§ 76-77, 11 October 2007; and Svetoslav Dimitrov v. Bulgaria, no. 55861/00, §§ 58-60, 7 February 2008).
134. It is also of some significance that there is an apparent contradiction between the position expressed on that point by the Ministry of Justice and the manner in which in 2021 it framed the new regulation governing the deletion of data relating to substitute administrative penalties imposed on third-country nationals in the EU criminal records database ECRIS-TCN (see paragraphs 44-45 above). In accordance with that regulation, all electronic data about such penalties are to be deleted after the retention period for the record card for the respective substitute administrative penalty has expired. It cannot be excluded that this difference in approach as to the time-limit for keeping the data is justified by the different purposes for which information in the domestic criminal records system (see paragraphs 46-48 above) and information in the ECRIS-TCN is disclosed. However, this is not apparent from the relevant regulations, and it does not seem that the difference has been explained.
135. It is true that the Bulgarian Supreme Administrative Court, which has the power to review the decisions of the Commission for the Protection of Personal Data, endorsed the interpretation favoured by the Ministry of Justice - that according to a proper construction of the relevant regulations, the electronic version of the data about substitute administrative penalties was to be retained indefinitely (see paragraphs 27 and 43 above). However, when doing so, that court did not attempt to explain how such indefinite retention could tally with, in particular, the principle of storage limitation in data protection law. The court confined itself to a reference to section 2(2)(1) and (2)(2) of the 2002 Act, which set out the data protection principles of lawful and fair processing and purpose limitation (see paragraph 56 (a) and (b) above), but said nothing about section 2(2)(6) of the same Act, which at the time set out the principle of storage limitation (see paragraph 56 (c) above). Indeed, that principle has been part and parcel of Bulgaria's domestic data protection law since before the amendment of section 2(2) of the 2002 Act in 2005, when the Act was brought into line with Directive 95/46/EC (see paragraph 57 above). The principle featured already in point (e) of Article 5 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (see paragraph 77 above), which has been part of Bulgarian domestic law since 2003 and takes precedence over any conflicting provisions of domestic legislation (see paragraph 50 above). The principle was then fully reaffirmed in Article 5 § 1 (e) of the GDPR, which has been directly applicable in Bulgaria since May 2018 (see paragraphs 60 and 68 (c) above, and, mutatis mutandis, Spasov v. Romania, no. 27122/14, §§ 92-93, 6 December 2022), as well as in the 2019 amendments to the 2002 Act transposing the LED (see paragraphs 56 (c), 57, 73 (c) and 74 above). It is not in doubt that this principle applies to the data retention in issue in the present case. The CJEU has recently confirmed that (a) all data protection principles apply to the processing of personal data relating to criminal convictions and offences, including road traffic offences (see paragraphs 69 and 72 above), and (b) those principles apply cumulatively, which means that any processing of personal data must comply with all and not just some of them (see paragraph 69 in fine above).
136. Another apparent inconsistency flows from the remark of the Supreme Administrative Court that the indefinite retention of data about substitute administrative penalties was necessary for a core law-enforcement purpose: to ensure effective implementation of the statutory bar on an offender being able to benefit from such a waiver of criminal liability more than once (see paragraphs 27 and 43 in fine above). Even if true, such a purpose does not seem to justify the indefinite retention of data. In addition, that remark is hard to square with the firm position of Bulgaria's former Supreme Court and its Supreme Court of Cassation that according to a proper construction of the relevant provisions of Bulgaria's Criminal Code, it is possible to benefit from a waiver of criminal liability again if more than one year has passed since the execution of any previous substitute administrative penalty or since the expiry of the limitation period for its enforcement (see paragraph 29 above).
137. In the light of these discrepancies, which are not for the Court to resolve, including as regards the application of EU law (see, mutatis mutandis, Parti nationaliste basque - Organisation régionale d'Iparralde v. France, no. 71251/01, § 48, ECHR 2007-II; Avotiņš v. Latvia [GC], no. 17502/07, § 100, 23 May 2016; Krombach v. France (dec.), no. 67521/14, § 39, 20 February 2018; Stoyan Nikolov v. Bulgaria, no. 68504/11, § 58, 20 July 2021; and Moraru v. Romania, no. 64480/19, § 54, 8 November 2022), it cannot be accepted that the ongoing retention of the data about the applicant's substitute administrative penalty is "in accordance with the law" within the meaning of Article 8 § 2 of the Convention.
(b) "Necessary in a democratic society" for attaining one or more of the aims in Article 8 § 2 of the Convention
138. The applicant submitted that the way in which the relevant domestic rules were framed left it uncertain what legitimate aim was being pursued by the indefinite retention of data about substitute administrative penalties. The aim cited by the Supreme Administrative Court - to ensure that no one could benefit from such a waiver of criminal liability more than once - clearly did not exist, since the Supreme Court of Cassation had clarified long ago that this was possible. In any event, such indefinite retention was disproportionate, especially since it concerned not only people seeking to apply for certain public-sector posts, but anyone who had received such a penalty.
139. The Government submitted that the indefinite retention of data about substitute administrative penalties was "necessary in a democratic society" for the narrow purpose of ensuring that only people with completely clean criminal records could be employed in certain security and law-enforcement services. This corresponded to several of the legitimate aims set out in Article 8 § 2 of the Convention. It was also of great importance, as the people employed in those services had to meet high moral and professional standards. There were no less intrusive means of ensuring that, and the resulting interference was quite limited, affecting only people willing to pursue such careers.
140. The finding in paragraph 137 above that the interference was not "in accordance with the law" obviates the need to determine whether it was "necessary in a democratic society" to attain one or more of the aims set out in Article 8 § 2 of the Convention (see Amann, § 81; M.M. v. the United Kingdom, § 207 in fine; and Dragan Petrović, § 84, all cited above).
(c) Conclusion
141. There has therefore been a violation of Article 8 of the Convention.
142. Article 41 of the Convention provides:
"If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party."
143. The applicant claimed 15,000 Bulgarian levs (BGN) in respect of the loss of earnings resulting from his dismissal from his post as a prison guard.
144. The Government submitted that although the applicant had been barred from occupying that post, he had remained in it for almost ten years because he had omitted to inform the authority employing him of his penalty. He could not seek compensation for damage flowing from the loss of a job which he had had no right to keep. Moreover, the loss of that job had not been a direct result of the retention and disclosure of the data about his penalty; it had flowed directly from the penalty itself. In the alternative, the Government disputed the quantum of the claim.
145. The Court may only afford just satisfaction under Article 41 of the Convention if it finds that there has been a violation of the Convention or the Protocols thereto, and also finds that the damage alleged to have been suffered stems from that specific violation (see Apostolovi v. Bulgaria, no. 32644/09, § 116, 7 November 2019; Genov and Sarbinska v. Bulgaria, no. 52358/15, § 96, 30 November 2021; and, more recently, Macatė v. Lithuania [GC], no. 61435/19, § 225, 23 January 2023). In the present case, the applicant was dismissed because the authority employing him became aware of his penalty (see paragraphs 10-11 above). However, the complaint about that actual disclosure of the data about the penalty was declared inadmissible (see paragraphs 93 and 122 above). It follows that his claim in respect of the loss of earnings resulting from his dismissal must likewise be rejected (see, mutatis mutandis, International Bank for Commerce and Development AD and Others v. Bulgaria, no. 7031/05, §§ 162 and 165, 2 June 2016).
146. The applicant also claimed compensation in respect of non-pecuniary damage, in an amount to be fixed by the Court.
147. The Government submitted that the actions of the authorities constituting a breach of Article 8 of the Convention had not caused the applicant non-pecuniary damage, and invited the Court to dismiss the claim. In the alternative, they submitted that it called for a minimal award.
148. As noted in paragraph 145 above, any award in this case cannot be based on damage suffered as a result of the actual disclosure of the data about the applicant's penalty to the authority which was employing him.
149. As for the ongoing retention of those data and the ensuing risk of their disclosure, it has already been found in paragraphs 111-115 above that there is no evidence that those matters have caused the applicant any real detriment. Indeed, he did not even indicate the nature of the non-pecuniary damage which he had allegedly suffered (see paragraph 146 above). Even if it is accepted that he has suffered non-pecuniary damage on account of the unresolved discrepancies in the legal regime governing the retention of data about substitute administrative penalties, the finding of a violation of Article 8 of the Convention provides him with sufficient just satisfaction in that regard (see, mutatis mutandis, Amann, § 94, and D.S. v. the United Kingdom, § 35, both cited above). It is hence not necessary to award him any monetary compensation in relation to that. As attested by the adjective "just" and the phrase "if necessary" in Article 41 of the Convention, the Court enjoys a certain discretion in the exercise of the power to afford the injured party such satisfaction as appears to it to be appropriate (see, as a recent authority, Molla Sali v. Greece (just satisfaction) [GC], no. 20452/14, § 32, 18 June 2020). In some cases, the public vindication of the wrong suffered by the applicant, in a judgment binding on the Contracting State, can be an appropriate form of redress in itself (ibid., § 33, with reference to Varnava and Others v. Turkey [GC], nos. 16064/90 and 8 others, § 224, ECHR 2009), especially when a law, procedure or practice is found to have fallen short of Convention standards. However, in the present case, there is no indication that this has had a tangible impact on the applicant.
150. It follows that the applicant's claim for compensation in respect of non-pecuniary damage must be dismissed.
151. The applicant sought reimbursement of 3,240 euros (EUR) incurred in fees for thirty-six hours of work by his lawyer on the proceedings before the Court, at a rate of EUR 90 per hour, plus EUR 900 incurred for the translation into English of his observations and claim for just satisfaction. He asked that any award under this head be made directly payable to his lawyer.
152. In support of that claim, the applicant submitted
(a) a retainer agreement concluded in April 2019, under whose terms the applicant's lawyer agreed to defer the payment of his fees until the end of the proceedings before the Court;
(b) a time sheet recording work by his lawyer on the case in April and May 2015 and in January, May and June 2023, and the translation costs incurred by the lawyer; and
(c) a contract for translation services between the applicant's lawyer and a translator, who appears to be the lawyer's son.
153. The Government pointed out that the retainer agreement between the applicant and his lawyer partly concerned legal services provided before that agreement had been concluded. In their view, an award under this head had to be lower than the claim. They also noted that the translation into English of the applicant's observations and claim for just satisfaction had been done by a person closely related to the applicant's lawyer, and that, as was evident from his professional experience, the applicant's lawyer had been fully capable of drawing up those submissions in English himself.
154. It is settled that costs and expenses may be awarded under Article 41 of the Convention if it is established that they were actually and necessarily incurred and are reasonable as to quantum.
(a) Lawyer's fees
155. In this case, the retainer agreement and time sheet submitted by the applicant are sufficient to show that he has actually incurred the lawyer's fees whose reimbursement he seeks. The mere fact that his lawyer agreed to defer the payment of those fees until the end of the proceedings before the Court is of no significance in that regard. A lawyer's fees have actually been incurred if the lawyer has deferred the payment of those fees without releasing the applicant from the obligation to pay them (see Merabishvili v. Georgia [GC], no. 72508/13, § 371, 28 November 2017, and Mukhin v. Russia, no. 3642/10, § 194, 14 December 2021). The fact that the retainer agreement was only concluded in 2019 rather than when the lawyer first started working on the applicant's case in 2015 does not in itself suggest that it does not also cover that earlier work.
156. As regards the necessity of the fees, it cannot be overlooked that some of them relate to (a) complaints declared inadmissible by the President of Section IV in the exercise of her powers under Rule 54 § 3 of the Rules of Court, when notice of part of the application was being given to the Government, and (b) the complaint about the actual disclosure of the data about the applicant's penalty, which was likewise declared inadmissible (see paragraphs 93 and 122 above). This calls for a certain reduction in the award (see International Bank for Commerce and Development AD and Others, cited above, § 169, with further references). No doubt arises as to the necessity of the remainder of the fees.
157. It can also be accepted that the remainder of the fees are reasonable as to quantum. The hourly rate charged by the applicant's lawyer (EUR 90) is slightly lower than that charged and accepted as reasonable in recent cases against Bulgaria of similar complexity (see Budinova and Chaprazov v. Bulgaria, no. 12567/13, §§ 104 and 108, 16 February 2021; Behar and Gutman v. Bulgaria, no. 29335/13, §§ 115 and 120, 16 February 2021; and Y and Others v. Bulgaria, no. 9077/18, § 144, 22 March 2022). In the light of the degree of difficulty of the issues raised by the present case and the content of the submissions made on behalf of the applicant, the number of hours claimed (thirty-six) is likewise reasonable.
158. In the light of these considerations, the applicant is to be awarded EUR 2,000, plus any tax that may be chargeable to him, in respect of lawyer's fees.
159. As for the EUR 900 in translation costs whose reimbursement was also sought by the applicant, those are also in principle recoverable under Article 41 of the Convention (see Handzhiyski, § 75, and Genov and Sarbinska, § 107, both cited above).
160. The first point to decide in relation to those costs is whether the applicant's lawyer actually incurred them. The fact that he apparently engaged his son to do the translation does not in itself mean that he did not actually incur costs for it; the Government did not suggest that the contract for translation services between the two (see paragraph 152 (c) above) did not reflect the reality of the situation.
161. It can also be accepted that the costs were in turn actually incurred by the applicant. It is true that the retainer agreement between him and his lawyer did not stipulate that the applicant had to cover translation or other costs incurred by the lawyer in connection with the proceedings before the Court (contrast, for instance, Genov and Sarbinska, cited above, § 107). However, under that agreement, the applicant undertook more generally to pay his lawyer remuneration whose final amount was to be fixed in a time sheet presented by the lawyer. In that time sheet, which the applicant accepted without objections, the lawyer mentioned not only his fees, but also those translation costs. It can therefore be accepted that the applicant is legally bound to reimburse his lawyer for those costs.
162. Those costs can also be accepted as necessary. Even if the applicant's lawyer was capable of drawing up the submissions in English on behalf of the applicant, it does not necessarily follow that it was unreasonable for him to draw them up in Bulgarian in this case and then have them translated into English. It should be noted in this connection that, in line with the Court's usual practice, the Vice-President of Section III gave the applicant permission under Rule 34 § 3 (a) of the Rules of Court to file his observations initially in Bulgarian.
163. Lastly, no objection has been made about the reasonableness of those translation costs. They are hence to be awarded in full (EUR 900), plus any tax that may be chargeable to the applicant.
(c) Payment of the award for costs
164. As requested by the applicant, the sums set out in paragraphs 158 and 163 above are to be paid directly into the bank account of his lawyer.
FOR THESE REASONS, THE COURT, UNANIMOUSLY,
- Declares the complaint concerning the ongoing retention and potential disclosure of the data about the applicant's substitute administrative penalty admissible, and the remainder of the application inadmissible;
- Holds that there has been a violation of Article 8 of the Convention;
- Holds that the finding of a violation of Article 8 of the Convention constitutes in itself sufficient just satisfaction for any non-pecuniary damage suffered by the applicant;
- Holds
(a) that the respondent State is to pay the applicant, within three months from the date on which this judgment becomes final in accordance with Article 44 § 2 of the Convention, EUR 2,900 (two thousand nine hundred euros), plus any tax that may be chargeable to the applicant, in respect of costs and expenses, to be converted into the currency of the respondent State at the rate applicable at the date of settlement and to be paid directly into the bank account of the applicant's lawyer, Mr A. Kashamov;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points;
- Dismisses the remainder of the applicant's claim for just satisfaction.
Done in English, and notified in writing on 16 April 2024, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Milan Blaško Pere Pastor Vilanova
Registrar President
In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the Rules of Court, the separate opinion of Judge Pavli is annexed to this judgment.
P.P.V.
M.B.
CONCURRING OPINION OF JUDGE PAVLI
1. I have voted in favour of the unanimous finding that there has been a violation of Article 8 of the Convention in the present case, but on different grounds than those relied on in the judgment. Unlike the majority, I am not persuaded that the problem is one of a lack of foreseeability of the domestic regulations.
2. In this connection, it is not decisive in my view that the interpretation of the relevant regulations by an administrative authority, albeit an expert one, is at odds with the reading of those same regulations by the national courts (see paragraphs 132-134 of the judgment). Nor is it a matter of foreseeability that the domestic courts "did not attempt to explain how such indefinite retention [of sensitive personal data] could tally with ... the principle of storage limitation in data protection law" (see paragraph 135 of the judgment) - the latter principle being a major consideration of proportionality in the domain of personal data processing. The majority have avoided entering into a proper necessity analysis in this case by sneaking in an abridged version of such analysis under the label of foreseeability.
3. Indefinite retention and continued processing of highly sensitive personal data, relating in this case to the applicant's spent criminal record, require compelling justification in a democratic society (see paragraph 124 and the cases cited therein). Such justification was lacking in the reasoning of the domestic courts. The main rationale put forward by the Supreme Administrative Court related to the supposed need to ensure compliance with certain provisions of criminal law on waivers of criminal liability. For the reasons set out in paragraph 136 of the judgment, again under the label of "foreseeability", such purported justification is far from convincing.
4. Conversely, in the Strasbourg proceedings, the respondent Government advanced a different line of justification, namely that the indefinite retention of the relevant data was necessary to ensure that only people with "completely clean criminal records" were eligible to apply for a small number of sensitive public-sector positions (see paragraph 139 of the judgment). But whatever the merits of that argument, it appears to have played no role in the reasoning of the Supreme Administrative Court.
5. In conclusion, a key underlying question that can be discerned in the present case and others recently decided by the Court (see, for example, N.F. and Others v. Russia, no. 3537/15 and 8 others, 12 September 2023) is the following: does Article 8 of the Convention encompass a right to rehabilitation for criminal offenders who have paid their debt to society, in connection with core aspects of their private lives, such as employment and other drivers of social reintegration? And if so, what are the contours of such a right? While the Court's case-law, as it currently stands, provides some partial answers in this regard, it has yet to deal head-on with this important set of questions.
[1] The retention period under the previous regulation - regulation 21(1) of Regulations no. 1 of 2000 (see paragraph 32 in fine above) - was one hundred years as well.
[2] Under the previous regulation - regulation 45(1) of Regulations no. 1 of 2000 (see paragraph 32 in fine above), as originally worded - record cards for substitute administrative penalties were to be kept for two years after the imposition of the penalty (the same period had been laid down in the earlier regulation 45(1) of Regulations no. 1 of 1986 - see paragraph 32 in fine above). In August 2005 regulation 45(1) of the 2000 Regulations was amended with effect from the beginning of 2006 to prescribe that such record cards were to be kept - like conviction record cards - for one hundred years after the birth of the people whom they concerned.
[3] Under the previous regulation - regulation 45(1) read in conjunction with regulation 21 of Regulations no. 1 of 2000 (see paragraph 32 in fine above) - record cards for administrative penalties could be microfilmed before their destruction if a special expert committee considered that necessary.
[4] Established by Regulation (EU) 2019/816 establishing a centralised system for the identification of member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System (ECRIS).
[5] It appears that this regulation was meant to give effect to Article 8 (Retention period for data storage) of Regulation (EU) 2019/816, according to which "[e]ach data record shall be stored in the central system for as long as the data related to the convictions of the person concerned are stored in the criminal records".
[6] The exchange of information between the central criminal records bureau and foreign criminal records authorities is governed by special rules, in particular as regards the exchange of information with other EU member States. Those rules are set out in regulations 47-50g. Most of those regulations were added in February 2013 to transpose Framework Decision 2009/315/JHA on the organisation and content of the exchange of information extracted from the criminal record between Member States and Decision 2009/316/JHA on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA, and then in December 2021 to transpose Directive (EU) 2019/884 amending Framework Decision 2009/315/JHA, as regards the exchange of information on third-country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Decision 2009/316/JHA.
[7] The 2002 Act had already been amended once in late 2005 to achieve harmonisation with EU law (see paragraph 57 below).
[8] And the wording of Article 6 § 1 of Directive 95/46/EC in turn closely matched that of Article 5 of the 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (see paragraph 50 above).
[9] https://www.nsi.bg/en/content/3747/crimes-chapters-penal-code-and-some-kind-crimes-and-according-results-proceedings (last accessed on 19 March 2024)
[10] https://www.mvr.bg/docs/librariesprovider5/newsdocs/мвр-2015г---пътна-карта-на-реформите.ppt?sfvrsn=4dbf6f0c_0 (last accessed on 19 March 2024)
BAILII: