[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1s77bY5d9Dd8j4N1zdrFjmpOWF9Or4UoFdLTTh0tjKE":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"5d32574a-8a26-40db-a0e4-cf26eb4ad002","BAC (Bulgaria) - 2984\u002F2026","bac-bulgaria-2984-2026-42e615","Created page with \"{{COURTdecisionBOX |Jurisdiction=Bulgaria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BAC (Bulgaria) |Court_Original_Name=Върховен аднимистративен съд |Court_English_Name=Supreme Administrative Court of Bulgaria‎ |Court_With_Country=BAC (Bulgaria) |Case_Number_Name=2984\u002F2026 |ECLI= |Original_Source_Name_1=Supreme Administrative Court of Bulgaria‎ |Original_Source_Link_1=https:\u002F\u002Fsac.justice.bg\u002Fspravki\u002Fdelo\u002F2984-2026\u002F |...\" New page {{COURTdecisionBOX |Jurisdiction=Bulgaria |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BAC (Bulgaria) |Court_Original_Name=Върховен аднимистративен съд |Court_English_Name=Supreme Administrative Court of Bulgaria‎ |Court_With_Country=BAC (Bulgaria) |Case_Number_Name=2984\u002F2026 |ECLI= |Original_Source_Name_1=Supreme Administrative Court of Bulgaria‎ |Original_Source_Link_1=https:\u002F\u002Fsac.justice.bg\u002Fspravki\u002Fdelo\u002F2984-2026\u002F |Original_Source_Language_1=Bulgarian |Original_Source_Language__Code_1=BG |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Started= |Date_Decided=13.10.2026 |Date_Published=13.10.2026 |Year=2026 |GDPR_Article_1=Article 15(1) GDPR |GDPR_Article_Link_1=Article 15 GDPR#1 |GDPR_Article_2=Article 15(3) GDPR |GDPR_Article_Link_2=Article 15 GDPR#3 |GDPR_Article_3=Article 23(1)(i) GDPR |GDPR_Article_Link_3=Article 23 GDPR#1i |GDPR_Article_4= |GDPR_Article_Link_4= |GDPR_Article_5= |GDPR_Article_Link_5= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1=ЗЗЛД |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |National_Law_Name_3= |National_Law_Link_3= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_From_Body=Administrative Court of Lovech(Bulgaria) |Appeal_From_Case_Number_Name=241\u002F2024 |Appeal_From_Status= |Appeal_From_Link=https:\u002F\u002Fsac.justice.bg\u002Fspravki\u002Fdelo\u002F2984-2026\u002F |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=iliandre | }} The Bulgarian Supreme Administrative Court upheld that a controller had failed to comply fully with its obligations under [[[[Article 15 GDPR|Article 15 GDPR]]]] by providing only an extract from its records to a data subject, instead of the requested document copies. == English Summary == === Facts === The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676\u002F2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that [[Article 15 GDPR|Article 15(3) GDPR]] requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487\u002F2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness of the processing of their data. Loan agreements, repayment schedules, credit applications, and related financial information may all contain personal data covered by this right. The BSAC clarified that access may be restricted to protect the rights and freedoms of third parties according to [[[[Article 23 GDPR|Article 23 GDPR]]#1]] GDPR. The controller had therefore to take care not to disclose personal data belonging to other individuals contained in the requested documents. However, no other applicable grounds for restricting access were established in this case. === Holding === The Court noted that Article [[[[Article 23 GDPR|Article 23 GDPR]]]] establishes certain restrictions on the right of access to personal data. Since the controller had not invoked national security, defence, public security, or any of the other grounds for restriction listed in Article 23(1)(a)–(h) and (j), the only relevant limitation in this case was Article 23(1)(i), concerning the rights and freedoms of others. Accordingly, the controller had to protect the personal data of third parties and must not disclose personal data relating to other individuals if such data appears in the requested documents. This limitation did not, however, justify withholding the applicant’s own personal data contained in the requested documents. The BSAC therefore upheld the finding that the controller had failed to comply fully with its obligations under [[[[Article 15 GDPR|Article 15 GDPR]]]] by providing only an extract from its records instead of the requested document copies, subject to the necessary protection of third-party rights. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Bulgarian original. Please refer to the Bulgarian original for more details. Case Initiated – Proceedings in the case have begun. iCase InitiatedCloseProceedings in the case have begun. A complaint or appeal has been filed with the court and assigned to a presiding judge at random (Art. 157, paras. 1 and 2 of the Administrative Procedure Code). Scheduled – The date, time, and courtroom for the public hearing in the case have been set (Art. 157, para. 1 of the Administrative Procedure Code). iScheduledClosedThe date, time, and courtroom for the public hearing in the case have been set (Art. 157, para. 1 of the Administrative Procedure Code). The court sends summonses to the parties to notify them of the scheduled hearing (Art. 138 of the Administrative Procedure Code). To be Scheduled – The case has been filed, and a date for the first court hearing is yet to be set. iSchedulingCloseThe case has been initiated, and a date for the first court hearing is to be set. Once the date is set, the parties will be notified in accordance with established procedure (Art. 157, para. 1 of the Administrative Procedure Code). You will be summoned for the hearing; no action is required on your part. Postponed – The hearing has been postponed to another date. iPostponedCloseThe hearing has been postponed to another date. Reasons for the postponement may include, for example, improper service of a summons on a party to the case or a request for postponement based on a valid reason for the failure of a party or its legal representative to appear—such as illness (Art. 139 of the Administrative Procedure Code), or the need to gather additional evidence. Case Dismissed for Technical Defects—If a technical defect is found in the filed complaint, such as the absence of a required element, like a signature, or proof of payment of the state fee, the court sends a notice to the appellant with appropriate instructions, setting a deadline for rectifying the irregularity (Art. 158, para. 1 of the Administrative Procedure Code). iSuspendedClosedIf an irregularity is found in the filed appeal—such as the absence of a required element, like a signature, or proof of payment of the state fee— the court sends a notice to the appellant with appropriate instructions, granting a deadline for rectifying the irregularity (Art. 158, para. 1 of the Administrative Procedure Code). If the instructions are not followed within the deadline, the appeal may be dismissed without consideration, and the proceedings in the case may be terminated (Art. 158, para. 3 of the Administrative Procedure Code). Review the instructions provided to you and correct the irregularity within the deadline—failure to do so will result in the case being terminated. Suspended—Proceedings in the case have been temporarily suspended. iSuspendedClosureProceedings in the case have been temporarily suspended. This may occur for various reasons provided for by law, such as: by agreement of the parties; pending the conclusion of other judicial or administrative proceedings relevant to the resolution of the dispute; or pending a ruling by the Constitutional Court on the constitutionality of an applicable law (Art. 154a, para. 1 of the Administrative Procedure Code). The time limits in the case are suspended until the grounds for suspension cease to exist. Pending Decision – The court hearings in the case have concluded. iPending DecisionClosedThe court hearings in the case have concluded. The court has gathered all necessary evidence and heard the arguments of the parties, after which it announced that it will issue a judicial decision. A decision or other ruling is pending within the statutory time limit (Art. 172, para. 1 of the Administrative Procedure Code). Dismissed – The proceedings in the case have been terminated without the court having ruled on the merits of the legal dispute. iDismissedClosureThe proceedings in the case have been concluded without the court having ruled on the merits of the legal dispute. This occurs when there is a procedural obstacle, for example, if the complaint has been withdrawn, if the contested act is not subject to judicial review, or if the complainant has no legal interest in the challenge (Article 159 of the Administrative Procedure Code). Decided – The court has issued a decision resolving the dispute on the merits. iDecidedCloseThe court has issued a decision resolving the dispute on the merits. In its decision, the court may revoke the contested administrative act, amend it, declare it null and void, or dismiss the appeal as unfounded (Art. 172, para. 2 of the Administrative Procedure Code). Ruling – The court has issued a ruling. iRulingCloseThe court has issued a ruling. Unlike a decision, which as a rule resolves the dispute on the merits, an order is a judicial act that resolves issues concerning the progress of the case (for example, staying the proceedings, suspension, or dismissal) or other matters expressly provided for by law (Art. 229 of the Administrative Procedure Code). Ordered – An order has been issued in the case, providing instructions or directing actions regarding its administration and progress (Article 158(3) of the Administrative Procedure Code). Issued – This status indicates that a judicial act has been issued (rendered) in the case. iIssuedClosureThis status indicates that a judicial act has been issued (rendered) in the case. The term “rendered” is general and may refer to any type of judicial act—a judgment, ruling, or order. Typically, this status means that the final act in the case has been drafted and is available to the parties. Archived – The proceedings have concluded and the case has been archived. The exact terms follow the court’s nomenclature and may vary depending on the specific case.","The Bulgarian Supreme Administrative Court ruled that a non-banking financial institution failed to comply with GDPR's Article 15 by providing only an extract of records instead of full document copies to a data subject. The court emphasized that data subjects have a right to copies of all documents containing their personal data, including loan agreements and payment information, unless specific restrictions under Article 23 GDPR apply, such as protecting third-party rights.","Bulgarian court rules data controller must provide document copies, not just extracts, under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BAC_(Bulgaria)_-_2984\u002F2026&diff=53405&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-14T11:17:49+00:00","2026-10-14T12:00:08.347387+00:00",7,[17,20],{"name":18,"type":19},"Supreme Administrative Court of Bulgaria","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":43,"vendors":44},[],[],{"slug":46,"title":47,"body":48,"framework_refs":49,"framework_notes":58},"bulgarian-court-rules-gdpr-article-15-violated-by-incomplete-data-access-response","Bulgarian Court Rules GDPR Article 15 Violated by Incomplete Data Access Response","A Bulgarian non-banking financial institution was found to have violated GDPR Article 15 by providing only an extract of records rather than full copies of documents containing a data subject's personal data. The court clarified that the right of access requires complete document copies — including loan agreements and payment records — not summaries or partial responses. This case highlights how organizations often underestimate the scope of data subject access requests (DSARs), treating them as administrative formalities rather than substantive legal obligations. Failure to comply fully with Article 15 exposes organizations to regulatory enforcement, reputational damage, and costly litigation.",[50,51,52,53,54,55,56,57],"GDPR Article 15 (Right of Access)","GDPR Article 23 (Restrictions)","GDPR Article 5(1)(a) (Lawfulness, Fairness, Transparency)","NIST Privacy Framework PR.DS-P1","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701:2019 Section 7.3.2 (Handling of Data Subject Requests)","ITIL Service Request Management (handling access requests as a formal service)",{}]