BAC (Bulgaria) - 2984/2026
Bulgarian court rules data controller must provide document copies, not just extracts, under GDPR.
Run Supreme Administrative Court of Bulgaria?
Get an email when a reviewed story names Supreme Administrative Court of Bulgaria, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Bulgarian Supreme Administrative Court ruled that a non-banking financial institution failed to comply with GDPR's Article 15 by providing only an extract of records instead of full document copies to a data subject. The court emphasized that data subjects have a right to copies of all documents containing their personal data, including loan agreements and payment information, unless specific restrictions under Article 23 GDPR apply, such as protecting third-party rights.
The lesson from this incident
Full lessonA Bulgarian non-banking financial institution was found to have violated GDPR Article 15 by providing only an extract of records rather than full copies of documents containing a data subject's personal data. The court clarified that the right of access requires complete document copies — including loan agreements and payment records — not summaries or partial responses. This case highlights how organizations often underestimate the scope of data subject access requests (DSARs), treating them as administrative formalities rather than substantive legal obligations. Failure to comply fully with Article 15 exposes organizations to regulatory enforcement, reputational damage, and costly litigation.