Published on 5 September 2022

FOURTH SECTION

Application no. 46067/16 Atanas Mihaylov YANKABAKOV against Bulgaria lodged on 28 July 2016 communicated on 19 August 2022

STATEMENT OF FACTS

1. The applicant, Mr Atanas Mihaylov Yankabakov, is a Bulgarian national who was born in 1959 and lives in Stara Zagora.

2. The facts of the case, as submitted by the applicant, may be summarised as follows.

3 . In December 2006 the Sliven Regional Court found the applicant guilty of unduly charging a patient, but waived his criminal liability and gave him a substitute administrative penalty – a fine of 600 Bulgarian levs – in application of Article 78a of the Criminal Code (see paragraph 14 below). That judgment became final on 12 January 2007.

4 . As required under the relevant regulations (see paragraphs 16 and 17 below), in January 2007 a record card ( бюлетин ) for penalty was drawn up and then stored in the Petrich District Court’s criminal-records bureau.

5 . In June 2014 the applicant asked the Petrich District Court to check whether it was still keeping the record card for his penalty, and if so to destroy it, since more than five years had elapsed since the judgment imposing the penalty had become final (see paragraph 20 below). He requested that any electronic archive of that card (see paragraph 17 below) be erased as well.

6 . In a letter of 9 June 2014 the Petrich District Court advised the applicant that since February 2013 the period after which such record cards were to be destroyed was fifteen years (see paragraph 20 below).

7 . Faced with that response, in July 2014 the applicant complained to the Commission for Protection of Personal Data (see paragraph 29 below). He argued that the February 2013 extension of the retention period for record cards for substitute administrative penalties from five to fifteen years had not operated retrospectively, and that the card for his penalty should have been destroyed owing to the expiry of the five-year period for its retention in January 2012. The processing of data about that penalty after that time was hence unlawful. The applicant urged the Commission to give directions for that processing to cease, and to fix a time-limit for the breach to be rectified.

8 . In its reply to the complaint, the Petrich District Court stated, inter alia , that it had not destroyed the record cards for substitute administrative penalties whose retention periods had expired since there was no special procedure for that and since it had no technical means to microfilm them before their destruction. It was keeping them apart in a special archive.

9 . In October 2014 the Commission upheld the applicant’s complaint, set aside the Petrich District Court’s refusal to erase his data, and fined that court. It found that the court’s letter (see paragraph 6 above) had amounted to a refusal to erase the data. It also found that the data’s retention after January 2012 – five years after the judgment imposing the applicant’s penalty had become final (see paragraph 3 above and paragraph 20 below) – had been unlawful, and could not be excused by the lack of suitable technical means or procedure for the destruction of record cards for substitute administrative penalties. The extension of the retention period for such cards from five to fifteen years in February 2013 (see paragraph 20 below) had not operated retrospectively – a view already expressed by the Supreme Judicial Council’s legal-affairs committee (see paragraph 23 below). Since in the circumstances the Petrich District Court’s duties as a data controller were clear, there was no need to give it directions in that regard, or to fix a time-limit for it to rectify the breach. That court was, however, to be fined for the breach (see реш. № Ж-807/2014 от 09.10.2014 г., КЗЛД ).

10 . The Petrich District Court sought judicial review of the Commission’s decision. The applicant made written submissions in his capacity as interested third party.

11 . In February 2015 the Sofia City Administrative Court declared the Commission’s decision to set aside the Petrich District Court’s refusal to erase the applicant’s data null and void, on the basis that the Commission had no competence to set aside administrative decisions. The court went on to quash the Commission’s decisions to uphold the applicant’s complaint and to fine the Petrich District Court. It noted that at the time when the applicant had asked that court to erase his data and that court had refused, the retention period for record cards for substitute administrative penalties had already been extended to fifteen years. The court had thus acted in line with the law as it had stood when it had made its decision, and hence lawfully. Holding otherwise would be inconsistent with the purpose of the relevant regulations, which was to enable the judicial and other authorities to use criminal-record data in their work. The retention period for the record card for the applicant’s penalty was fifteen years, until January 2022, and the processing of data about that penalty by the Petrich District Court until that time was lawful (see реш. № 665 от 09.02.2015 г. по адм. д. № 10868/2014 г., АдмС-София-град ).

12 . The Commission and the applicant appealed on points of law. The applicant argued, inter alia , that the extension of the retention period for such record cards from five to fifteen years in February 2013 had not operated retrospectively and could not validate the unlawfulness of the processing of data about his penalty between the expiry of the five-year retention period in January 2012 and the entry of the amendment into force in February 2013.

13 . On 6 June 2016 the Supreme Administrative Court upheld the lower court’s judgment. It also held that the Commission had been wrong to find that the Petrich District Court had been processing the applicant’s data unlawfully. That court had been doing so for lawful purposes, and had not retained the data in breach of a relevant time-limit. Under the applicable regulation, as worded until February 2013 , a record card for a substitute administrative penalty was to be destroyed five years after the judgment imposing that penalty had become final, and in February 2013 that period had been extended to fifteen years (see paragraph 20 below). But there was no provision for the data from that record card to be erased as well; they were to be retained in both the alphabetical index and the electronic archive kept by the competent criminal-records bureau (see paragraphs 17 and 18 below). This was fully in line with Article 78a § 1 (b) of the Criminal Code, according to which no-one could benefit from a waiver of criminal liability more than once (see paragraph 14 below) (see реш. № 6695 от 06.06.2016 г. по адм. д. № 5685/2015 г., ВАС, V о. ).

RELEVANT LEGAL FRAMEWORK

14 . In some circumstances, Article 78a §§ 1 and 4 of the Criminal Code requires the courts to waive a convicted person’s criminal liability and replace it with an administrative penalty. According to Article 78a § 1 (b), that possibility is available only once, but the former Supreme Court and the Supreme Court of Cassation have held that it can become available again if more than one year has passed since the execution of the first such administrative penalty or the expiry of the limitation period for its enforcement (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4 , and тълк. реш. № 2 от 28.02.2018 г. по тълк. д. № 2/2017 г., ВКС, ОСНК, т. 7 и 8 ). The former Supreme Court has clarified that people who have been given such a substitute administrative penalty are considered not to have been criminally convicted (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4 ).

15 . People sanctioned under Article 78a of the Criminal Code cannot serve as officers in the National Security Service (section 39(3)(1) of the National Security Service Act 2015) or as forest guards (section 198(2)(2) of the Forests Act 2011). Until mid-2014, they could not serve as officers in the Ministry of Internal Affairs either (section 179(1)(2) of the Ministry of Internal Affairs Act 2006, repealed in 2014, and its predecessor, section 193(1)(2) of the Ministry of Internal Affairs Act 1997).

16 . The retention and disclosure of data about convictions and substitute administrative penalties (see paragraph 14 above) is governed by Regulations no. 8 of 2008 of the Minister of Justice ( Наредба № 8 от 26.02.2008 г. за функциите и организацията на дейността на бюрата за съдимост ). Under those regulations, there is a criminal-records bureau attached to each district court, plus a Central Criminal-Records Bureau (regulations 2 and 3; see also section 77(3) and (4) of the Judiciary Act 2007). Each bureau retains and makes available criminal records about people born in the respective judicial district who have been convicted by the Bulgarian courts or given a substitute administrative penalty (regulation 2(1)).

17 . Criminal records are retained in the form of (a) conviction record cards (regulations 6-25), and (b) record cards for substitute administrative penalties (regulations 26-32). Until the end of 2021, those record cards were in paper form only, with an electronic archive of the paper original (regulations 5(1), 8(2), 13(1) and 27(1), as worded until the end of 2021). Since the beginning of 2022, the cards are to be kept in both electronic and paper form, the paper form consisting of a printout of the electronic record (regulations 5(1), 8(2) and (3), 13(1) and 27(1)-(3), as worded since the beginning of 2022).

18 . Each criminal-records bureau must also keep an alphabetical index and an incoming register of all record cards which it has received; the index has both a paper and an electronic version (regulations 5(2), 13(1) and 28(1)).

(a) Conviction record cards

19 . Conviction record cards must be destroyed one hundred years after the people whom they concern have been born (regulation 24(1)). [1] By regulation 24(1) in fine , as worded until the end of 2021, the cards had to be microfilmed before their destruction. The amending regulations, issued in July 2020, did not say what was to become of all existing microfilms. The Supreme Administrative Court has noted on a number of occasions that the destruction of conviction record cards in application of regulation 24(1) does not entail the erasure of the data that they contain (see реш. № 7769 от 26.06.2015 г. по адм. д. № 13082/2014 г., ВАС, V о. ; реш. № 12582 от 24.11.2015 г. по адм. д. № 4683/2015 г., ВАС, V о. ; реш. № 12775 от 27.11.2015 г. по адм. д. № 15330/2014 г., ВАС, V о. ; реш. № 5563 от 11.05.2016 г. по адм. д. № 4687/2015 г., ВАС, V о. ; реш. № 7180 от 15.06.2016 г. по адм. д. № 7040/2015 г., ВАС, V о. ; реш. № 10799 от 17.10.2016 г. по адм. д. № 7455/2015 г., ВАС, V о. ; реш. № 13136 от 05.12.2016 г. по адм. д. № 10757/2015 г., ВАС, V о. ; реш. № 13606 от 13.12.2016 г. по адм. д. № 10389/2015 г., ВАС, V о. ; реш. № 1562 от 7.02.2017 г. по адм. д. № 12908/2015 г., ВАС, V о. ; реш. № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о. ; реш. № 15447 от 15.12.2017 г. по адм. д. № 4813/2017 г., ВАС, V о. ; реш. № 4156 от 30.03.2018 г. по адм. д. № 4191/2016 г., ВАС, V о. ; and опр. № 7233 от 15.05.2019 г. по адм. д. № 4329/2019 г., ВАС, V о. ).

(b) Record cards for substitute administrative penalties

20 . Under regulation 31(1), as worded initially in 2008, record cards for substitute administrative penalties were to be destroyed five years after the judgments to which they related had become final. [2] With effect from 15 February 2013, that five-year period was extended to fifteen years. In contrast to the position with respect to conviction record cards (see paragraph 19 above), the regulations did not prescribe that record cards for substitute administrative penalties had to be microfilmed before their destruction. [3]

21 . The data relating to record cards for substitute administrative penalties in the alphabetical indexes kept by the criminal-records bureaus (see paragraph 18 above) are, for their part, not subject to erasure (regulations 24(2) and 28(3), the latter inserted with effect from 15 February 2013).

22 . The extension of the retention period for record cards for substitute administrative penalties from five to fifteen years threw up the question what was to become of cards which ought to have been destroyed owing to the expiry of the five-year period before the entry into force of the amendment extending it to fifteen years.

23 . On 17 February 2014 the Supreme Judicial Council’s legal-affairs committee resolved that cards whose five-year retention period had expired by the time when the amendment had come into force on 15 February 2013 were to be destroyed, and those whose five-year retention period had not expired by that time were to be kept for fifteen years after their creation.

24 . The question then arose what was to become of the electronic archives of the record cards due for destruction and of the data taken from them and entered into the alphabetical indexes and incoming registers kept by the criminal-records bureaus (see paragraphs 17 and 18 above). The Supreme Judicial Council’s legal-affairs committee sought an opinion on the point from the Commission for Protection of Personal Data. In that opinion ( Становище № П-2737 от 28.07.2014 г. ), issued in July 2014, the Commission noted that the position of the Ministry of Justice was that under a proper interpretation of Regulations no. 8, the data taken from the record cards were to be retained indefinitely (in contrast to the cards themselves). In the Commission’s view, however, such indefinite retention ran counter to data-protection principles and to the proper protection of the private lives of those concerned. For the Commission, the data taken from the record cards had to be erased alongside the cards.

25 . For its part, in four nearly identically reasoned judgments given in 2014-16 (the last of which was that in the applicant’s case – see paragraph 13 above), the Supreme Administrative Court held that even when the five-year period for storing record cards for substitute administrative penalties expired, the data from them were not subject to erasure, since they had to be kept in the criminal-records bureaus’ alphabetical indexes and electronic archives (see paragraphs 17 and 18 above). In the court’s view, that was fully in line with Article 78a § 1 (b) of the Criminal Code (see paragraph 14 above), according to which no-one could benefit from a waiver of criminal liability more than once (see реш. № 14179 от 27.11.2014 г. по адм. д. № 2069/2014 г., ВАС, V о. ; реш. № 4204 от 16.04.2015 г. по адм. д. № 9350/2014 г., ВАС, V о. ; реш. № 4355 от 13.04.2016 г. по адм. д. № 3879/2015 г., ВАС, V о. ; and реш. № 6695 от 06.06.2016 г. по адм. д. № 5685/2015 г., ВАС, V о. ).

26 . By regulations 4(1) and 33, a district court’s criminal-records bureau can disclose someone’s criminal record in one of two ways:

(a) By issuing a conviction certificate pursuant to a request by the people concerned. From September 2022, it will in addition be possible for some authorities to obtain such certificates directly, in electronic form, when by law they have to check someone’s criminal record (new regulation 35b, due to come into effect in September 2022). This latter possibility will be open solely with respect to people who have neither a conviction record card nor a record card for a substitute administrative penalty (regulation 35b(1)); [4] or

(b) By issuing a criminal-record report. Such a report can only be sought for official purposes by the authorities empowered to do so (regulation 33(5)). Those include (i) the criminal courts, the prosecutor’s offices and the investigating authorities; (ii) the various security services tasked with vetting people for the purpose of clearance to access classified information; (iii) other State authorities or bodies authorised by law to obtain such data; (iv) foreign judicial authorities (if that is prescribed by a treaty or by European Union law); (v) the central criminal-record authorities of other member States of the European Union; and (vi) foreign diplomatic or consular missions, in respect of nationals of their own States.

27 . A conviction certificate only contains data about convictions (regulation 39(1)). It must moreover not mention any convictions for offences in respect of which the person concerned has been rehabilitated (regulation 39(2)(2)), unless a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, but in that case the certificate must specifically mention that the person concerned has been rehabilitated and set out the date of that rehabilitation (regulation 39(3)).

28 . A criminal-record report contains data about both convictions and substitute administrative penalties (regulation 40(1)). It must mention all convictions, irrespective of rehabilitation (regulation 36(2)). A new regulation 36b, added in 2020 and due to come into effect in September 2022, carved out a limited exception to that general rule: if the criminal-record report is requested by a State authority or body of the type mentioned in paragraph 26 (b)(iii) above, it must not mention any substitute administrative penalties or any convictions in respect of offences for which the person concerned has been rehabilitated (except if a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, in which case the criminal-record report must specifically mention that the person concerned has been rehabilitated and set out the date of that rehabilitation).

29 . At the relevant time and until February 2019, section 38(1) of the Protection of Personal Data Act 2002 provided that anyone could complain to the Commission for Protection of Personal Data of a breach of his or her rights under the Act. The Commission’s powers in such proceedings were to (a) give directions to the data controller, (b) fix a time-limit for the breach to be put right, or (c) impose an administrative penalty (section 38(2), as worded until February 2019). In cases of processing of personal data for the purposes of national defence, national security, public order or criminal proceedings, the Commission’s powers were limited to declaring whether the processing was lawful (section 38(5), currently section 38(6)). The Supreme Administrative Court has held that in such cases the Commission could not prescribe any remedial measures, but the case was to be referred back to the relevant authority for it to decide how to proceed based on the Commission’s findings (see реш. № 13202 от 03.12.2008 г. по адм. д. № 10153/2008 г., ВАС, петчл. с-в ). The Commission’s decision was amenable to judicial review (section 38(6), currently section 38(7)).

30 . Aggrieved individuals could alternatively seek judicial review of the data controller’s decisions or actions, plus damages (section 39(1) and (2), as worded until February 2019). That remedial avenue could not be used if the person concerned had turned to the Commission, until the proceedings before the Commission (and any proceedings for judicial review of its decision) had ended (section 39(4), as worded until February 2019).

31 . In February 2019, when the Protection of Personal Data Act 2002 was brought into line with the General Data Protection Regulation (“GDPR”) and Directive (EU) 2016/680, that system of remedies was retained (except with respect to data processing by the courts and the prosecuting and investigating authorities for law-enforcement purposes), but the Commission’s powers were harmonised with Article 58 § 2 (a)-(h) and (j) of the GDPR (sections 38(3) and 82(1) of the Act, as worded since February 2019).

32 . Since February 2019, the administrative remedy in respect of data processing by the authorities for law-enforcement purposes has been a complaint to the Inspectorate attached to the Supreme Judicial Council (sections 38b(1) and 82(1), as worded since February 2019). The judicial remedy remains a claim for judicial review of the data controller’s or data processor’s decisions or actions, possibly coupled with a claim for damages (sections 39(1) and (2) and 82(1), as worded since February 2019). The bar on parallel proceedings before the Commission, respectively the Inspectorate (and any proceedings for judicial review of their decisions), and judicial-review proceedings against the data controller remained (section 39(4) and (5), as worded since February 2019).

COMPLAINTS

33. The applicant complains under Article 8 of the Convention that (a) the record card for his substitute administrative penalty was kept after the end of the period for its retention, and that (b) the electronic data from that record card were to be retained possibly indefinitely.

34. The applicant also complains under Article 6 § 1 of the Convention that in the proceedings for judicial review of the decision of the Commission for Protection of Personal Data the courts did not give proper reasons for their judgments, and the Supreme Administrative Court in particular failed to express a clear view on whether the record card for the applicant’s substitute administrative penalty should have been retained for five or fifteen years.

QUESTIONS TO THE PARTIES

1. Has there been a breach of Article 8 of the Convention?

1.1. More specifically, was the retention and potential disclosure of the data about the applicant’s substitute administrative penalty under Article 78a of the Criminal Code “in accordance with the law” – in the light of, in particular, the varying opinions of different domestic authorities on whether:

(a) the record cards for such penalties whose five-year retention period had expired when the relevant regulations were amended to extend that period to fifteen years in February 2013 were to be destroyed; and

(b) the electronic data from such record cards were to be retained irrespective of the destruction of the cards themselves?

1.2. Also, was the retention and potential disclosure of those data “necessary in a democratic society” to attain a legitimate aim – in the light of, in particular, the apparently indefinite retention of their electronic version?

2. Did the applicant have a “fair ... hearing” in the proceedings for judicial review of the decision of the Commission for Protection of Personal Data, as required by Article 6 § 1 of the Convention? In particular, did the Supreme Administrative Court duly engage with his argument that the February 2013 amendment to the relevant regulations extending the period to keep record cards for substitute administrative penalties from five to fifteen years had not operated retrospectively?

[1] . The retention period under the previous regulation – regulation 21(1) of Regulations no. 1 of 2000 of the Minister of Justice – was one hundred years as well.

[2] . Under the previous regulation – regulation 45(1) of Regulations no. 1 of 2000, as originally worded – those record cards had to be kept for two years after the imposition of the penalty. In August 2005 regulation 45(1) was amended with effect from the beginning of 2006 to prescribe that those record cards were likewise to be kept for one hundred years after the birth of the people whom they concerned.

[3] . Under the previous regulation – regulation 45(1) read in conjunction with regulation 21 of the Regulations no. 1 of 2000 – record cards for administrative penalties could be microfilmed before their destruction if that was considered necessary by a special expert committee.

[4] . In an opinion given in January 2018 ( Становище № НДМСПО-10-1/2018 г. ), the Commission for Protection of Personal Data noted that this would make it possible to find out indirectly whether someone has a substitute administrative penalty, even though such penalties are not to be mentioned in conviction certificates but only in criminal-record reports (see paragraphs 27 and 28 above), and would thus run counter to the principles of data minimisation and lawfulness . In its response, the Ministry of Justice stated that the automated system for issuing such certificates could only function without human intervention if no record cards whatsoever exist with respect to the person concerned, and on that basis refused to alter the text of regulation 35b(1).