skip to content

Data Protection Laws and Freedom of Expression:  BulgariaFile:Flag of Bulgaria.svg


Constitutional/Primary Law Background - See also ECHR and EU Charter

The Bulgarian Constitution (as revised 2015) does not protect a right to data protection as such but otherwise includes a large number of relevant rights. As regards freedom of expression:

  • Article 39 of the Bulgarian Constitution (as revised 2015) protects right to express and publicise an opinion, subject to certain enumerated exceptions such as where it is used to the detriment of the rights and reputation of others or to the incitement of enmity or violence against anyone.   
  • Article 40 establishes freedom of mass media, prohibits censorship and establishes that an injunction or confiscation of information media can only be effects by a judicial act on very limited grounds including incitement of violence against anyone.
  • Article 41 protects the right to seek, obtain and disseminate information subject to a number of enumerated exceptions including where this is exercised to the detriment of the rights and reputation of others.

 As regards privacy:

  • Article 32 provides for the inviolability of the privacy of citizens and protection against unlawful interference/enforcement on private and family affairs, honour, dignity and reputation.  Save where permitted by law, it also prohibits following, photographing, filming or recording another without their knowledge or despite express disapproval.
  • Article 33 establishes the inviolability of the home, with entry or stay without the occupants consent generally prohibited.
  • Article 32 establishes the freedom and confidentiality of communications, with exceptions only permitted judicially and for the purpose of discovering or preventing a grave crime.

The earliest protection for freedom of expression, which was based on the 1831 Belgium Constitution, was found in section 8 of the 1879 Constitution.  The 1911 version included protections for the home and the secrecy of communications (letters and telegrams) – see sections 74 and 77.  Constitutional rights to privacy, private and family affairs, honour, dignity, reputation and restrictions on photography, recording etc. were only included in the 1991 Constitution.


First-Generation Statutory Law

Bulgaria did not adopt any data protection statute in the first-generation period.


Second-Generation Statutory Law

Bulgaria first adopted a Law for the Protection of Personal Data in January 2002.   This Act was significantly amended especially during 2005.  Bulgaria joined the EU on 1 January 2007.


Special Expression Derogation

From 2005, Bulgaria set out a broadly applicable derogation which incorporated a strict public interest test (Law for the Protection of Personal Data, art. 4(2), art. 5(7) and art. 36(a)(7)). The law provided for a journalistic exemption from the proactive aspects of the transparency rules, the sensitive data rules and the control conditions ‘to the extent to which such processing does not violate the right to privacy of the person whom the data relate’. Data quality principles applied without restrictions to the media. A narrow derogation was provided from the retroactive transparency rule to protect the confidentiality of sources of information held by journalists. These derogations extended to artistic and literary forms of expression.

Broad Expression Derogation
There was no special provision.

Personal Exemption
Whilst a personal exemption was present the beginning, the wording was changed from 2005.This stated that the Act did not apply to the processing of personal data by individuals for their personal or household activity (ibid, art. 1(9)).

Knowledge Facilitation Derogation
Whilst provisions related to historical, scientific or statistical purposes and also research were present from the beginning, the provisions here were significantly amended in 2005.These provisions provided for a compatibility exemption for historical, statistical, or research purposes provided that the administrator ensured the proper protection that such data are not processed for any other purpose. Moreover, it was stated that data used for historical, statistical or research purposes stored beyond the set period of time ‘shall be stored in a format precluding identification of individuals’ (ibid, art. 2(6)).However, no exemption beyond those of set out within Directive 95/46 for knowledge facilitation purposes was set out e.g. vis-à-vis the transparency rules, sensitive data rules and control conditions. Nevertheless, data stored in the National Archive Fund was excluded entirely from the legislation (ibid, art. 1(6)).[1]

Parliamentary Debates
The Government proposal for a data protection act was introduced in 2001, closely modelled on a Bill sponsored by the leader of the opposition UDF party earlier that year.  The Act as adopted was closely modelled on the Government’s proposals which included a personal exemption and provisions related to research and also historical, scientific or statistical purposes but not journalism or similar forms of expression.  The plenary debates at both first and second reading did not focus on any of these issues.  A Government Bill in 2005 proposed significant modifications to the Act which inter alia established the wording of the personal exemption and also the broad governance of historical, statistical, scientific and scientific research purposes throughout the rest of this period.  The principal rationale for these changes was to align the legislation more precisely to Directive 95/46.  The exemption for journalistic purposes and literary and artistic expression was also introduced at this time.


Third-Generation Statutory Law

Bulgaria Personal Data Protection Act on 20 February 2019 (with further amendments adopted later that year).


Special Expression Derogation
The Bulgarian Data Protection Act implementing the GDPR establishes that processing for journalistic purposes as well as academic, artistic or literary expression is lawful when carried out on the grounds of freedom of expression and information whilst simultaneously respecting privacy (s. 25h(1)).  Another clause states that as regards any disclosure of personal data. This should be assessed through a list of objective criteria (s. 24h(2)). In combination, these tests appeared to set out an objective or stringent derogation.  However, this second clause was declared unconstitutional by Decision No 8 of 2019 of the Bulgarian Constitutional Court.  These provisions do not explicitly establish the priority of the special expression derogation over the Knowledge Facilitation Framework.

Broad Expression Derogation
There is no provision.

Personal Exemption – see GDPR, art. 2(2)(c)

Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Data processing for National Archiving Fund purposes is found as processing in public interest. Arts 15, 16 and 18-21 GDPR do not apply in such cases. In case data is processed for statistical purposes, Arts 16, 16, 18 and 21 are exempted from application (Ibid, art 25(k)).

Personal data originally collected for different purposes may be used for scientific or historic research and statistical purposes (Ibid, art 25(m)). Such processing must, however, be permitted pursuant to EU or Bulgarian law and be necessary and proportionate (Ibid, art 45(3)). Moreover, appropriate safeguards for the protection of the affected data subject’s rights and freedoms must be ensured. In particular, the processing must be ‘appropriate, relevant and not go beyond what is necessary’, ‘accurate and, if necessary, kept up-to-date’, ‘stored in a form which permits identification of the data subject for a period no longer than is necessary for the purposes’ and ‘processed in such a way as to ensure an adequate level of security of personal data’ (Ibid, art 45(1)).

Parliamentary Debates
Special Expression Derogation
Pursuant to Art. 25h(2), ten criteria should be used by journalists, academics, artists and writers to assess whether and to what extent an adequate balance between freedom of expression and information and data protection has been achieved. This ten-criteria test, however, was criticized. Due to its abstract character, it was argued that it would not achieve the required balance between data protection and freedom of expression and would disproportionately restrict the exercise of freedom of expression. The Chairman of the Commission for Personal Data Protection (Ventsislav Karadzhov) countered that neither of the two rights are absolute and the ten-criteria test would provide for an objective assessment to be made on a case-by-case basis. He moreover noted that while the ten criteria provided were not exhaustive, they would ensure maximum transparency as well as a uniform interpretation and application of the law and thus avoid subjectivity. The Chairman emphasized that the overall context and legal regime applicable to the media as a whole would have to be taken into account. He then went on to elaborate that the processing of personal data for journalistic purposes was exempted from the need for a legal basis under the Regulation. This would ensure the seamless collection and analysis of personal data for journalistic purposes. The adequate protection of personal data would thereby be ensured by three different instances. The first being the journalists themselves, the second the Commission for Personal Data Protection which may receive complaints about the processing of personal data for journalistic purposes and finally the court which assesses appeals against decisions by the Commission for Personal Data Protection. Each of these instances must thereby determine on the basis of the ten criteria provided whether the right to freedom of expression and to data protection have been adequately balanced. In each case, the ten-criteria test is supplemented with an assessment of the public interests involved. The Chairman emphasized that these criteria derived from the established case law of the ECtHR and would not serve as a checklist, but rather as principles and objective guidelines against which the balance of the two rights in questions would have to be assessed on a case-by-case basis. Speaking on behalf of the Interior Ministry, Krassimir Tsipov expressed support for the proposed ten-criteria test, arguing that it would ensure that the right balance between freedom of expression and data protection is achieved. MPs Radev, Savateva, Tsvetanov, Karadzhov, Manev and Nunev also supported the provision, emphasizing that the ten-criteria test would ensure journalistic freedom of expression. The President, in contrast, vetoed the provision as it did in his opinion not struck the right balance between the affected rights. This veto was supported by the Association of European Journalists. The ten criteria were, however, eventually adopted by Parliament, with a number of MPs, vocally disagreeing with the President’s stance.[2]  (However, as noted in the box above this provision was declared unconstitutional by Decision No 8 of 2019 of the Bulgarian Constitutional Court.

No further debates of interest took place.


[1] Ibid, art. 1(9).

[2] ‘ДВЕСТА И ТРИДЕСЕТО ЗАСЕДАНИЕ София, сряда, 20 февруари 2019 г.Открито в 9,00 ч.’ (last accessed 30 July 2020).