(i) Exhaustion of domestic remedies

(ii) Compliance with the six-month time-limit

(i) The actual disclosure

(ii) Alleged ongoing retention and ensuing risk of disclosure

2. Alleged loss of victim status

3. No significant disadvantage

(i) “Significant disadvantage”

(ii) “Respect for human rights”

4. Conclusion on the admissibility of the complaints

C. Merits

1. Existence of an interference

2. Whether that interference is justified

(a) “In accordance with the law”

(β) Application of those principles

(α) General principles

(b) “Necessary in a democratic society” for attaining one or more of the aims in Article 8 § 2 of the Convention

II. APPLICATION OF ARTICLE 41 OF THE CONVENTION

A. Pecuniary damage

1. The applicant’s claim and the Government’s comments on it

2. The Court’s assessment

B. Non-pecuniary damage

1. The applicant’s claim and the Government’s comments on it

2. The Court’s assessment

C. Costs and expenses

1. The applicant’s claim and the Government’s comments on it

2. The Court’s assessment

(a) Lawyer’s fees

(b) Translation costs

CONCURRING OPINION OF JUDGE PAVLI

In the case of Borislav Tonchev v. Bulgaria,

The European Court of Human Rights (Third Section), sitting as a Chamber composed of:

Pere Pastor Vilanova, President,
Jolien Schukking,
Yonko Grozev,
Darian Pavli,
Peeter Roosma,
Ioannis Ktistakis,
Oddný Mjöll Arnardóttir, judges,
and Milan Blaško, Section Registrar,

Having regard to:

the application (no. 40519/15) against the Republic of Bulgaria lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Bulgarian national, Mr Borislav Kirilov Tonchev (“the applicant”), on 10 August 2015;

the decision to give the Bulgarian Government (“the Government”) notice of the complaint under Article 8 of the Convention about the retention and the actual and potential disclosure of the applicant’s criminal record, and to declare inadmissible the remainder of the application; and

the parties’ observations;

Having deliberated in private on 19 March 2024,

Delivers the following judgment, which was adopted on that date:

INTRODUCTION

1. The key issue in this case is whether the allegedly indefinite retention of data about a substitute administrative penalty (a type of non-conviction disposal of a criminal case) imposed on the applicant in 2004 is “in accordance with the law” within the meaning of Article 8 § 2 of the Convention, particularly in the light of the diverging views of various national authorities on whether the relevant domestic regulations require such indefinite retention and whether it is consistent with data protection law.

THE FACTS

2. The applicant was born in 1981 and lives in Lovech. He was represented by Mr A. Kashamov, a lawyer practising in Sofia.

3. The Government were represented by their Agent, Ms M. Ilcheva of the Ministry of Justice.

THE APPLICANT’S APPOINTMENT AS A PRISON GUARD

4. In March 2004 the applicant applied for the post of prison guard. In support of his application, he submitted a conviction certificate (see paragraphs 46 (a) and 47 below) issued on 12 March 2004, and certificates issued again in March 2004 by the local district prosecutor’s office and investigation service attesting that he had no convictions or sentences or substitute administrative penalties.

5. In June 2004 the applicant was appointed as a prison guard, with effect from 1 July 2004.

THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY

6. In the meantime, in May 2004 the applicant had been caught driving his car while drunk. In September 2004 the Pleven District Court found him guilty of driving a motor vehicle while having a blood alcohol content of more than 1.2 per mille, contrary to Article 343b § 1 of the Criminal Code (a formal wilful offence). The court waived his criminal liability, but found that he was administratively liable and gave him a substitute administrative penalty – a fine of 500 Bulgarian levs (BGN) – in accordance with Article 78a of the same Code (see paragraph 29 below). That judgment became final on 20 October 2004.

7. As required under the relevant regulations (see paragraphs 33-35 below), on 26 October 2004 a record card (бюлетин) for that penalty was drawn up and stored in the Troyan District Court’s criminal records bureau.

8. On 11 January 2005 the applicant paid the fine.

THE APPLICANT’S DISMISSAL AND HIS LEGAL CHALLENGE AGAINST IT

9. In July 2012 the Ministry of Justice opened a competition for posts in the directorate responsible for ensuring the security of the judiciary. In August 2012 the applicant applied for one of those posts. Following that application, on 14 August 2012 that directorate sought and obtained from the Lovech District Court’s criminal records bureau a criminal record report (see paragraphs 46 (b) and 48 below) which mentioned the applicant’s substitute administrative penalty (see paragraph 6 above). To issue the report, the bureau obtained data about that penalty electronically, from the Troyan District Court’s criminal records bureau, which was keeping the record card for the penalty (see paragraph 7 above). On 23 August 2012 that directorate again sought and obtained from the Lovech bureau a criminal record report which also mentioned the penalty, but added that in the meantime, on 20 August 2012 the record card for the penalty had been destroyed (see paragraphs 16-17 below). On the basis of the data about his penalty, in October 2012 the applicant was not allowed to participate in the appointment competition.

10. The criminal record report issued on 14 August 2012 was also sent to the authority employing the applicant, the Chief Directorate for the Execution of Punishments. In the light of the data about his penalty, in November 2012 the Chief Directorate also sought from the Troyan District Court’s criminal records bureau a criminal record report about the applicant. The report, which became available on 28 November 2012, stated that the applicant had no convictions and did not mention his substitute administrative penalty. The Chief Directorate invited the Troyan bureau to explain the discrepancy between that report and the earlier report by the Lovech bureau (see paragraph 9 above). In a letter of 10 January 2013 the Troyan District Court explained that the discrepancy was due to the record card for the applicant’s penalty being destroyed on 19 November 2012 (see paragraphs 16-17 below).

11. In March 2013 the Chief Directorate dismissed the applicant from his post as a prison guard, on the basis that the criminal record report issued by the Lovech District Court’s criminal records bureau and the information from the Troyan District Court showed that he had received a substitute administrative penalty, and that his remaining in that post was incompatible with such a penalty, in accordance with statute law (see paragraph 30 in fine below).

12. The applicant sought judicial review of his dismissal. He argued, inter alia, that the Chief Directorate had obtained the data about his penalty unlawfully. The only way in which an employer could access criminal record data was by way of a conviction certificate; criminal record reports could only be used for law-enforcement purposes.

13. In February 2014 the Sofia City Administrative Court dismissed the claim. It held, inter alia, that the fact that the data about the applicant’s penalty had been obtained by way of a criminal record report issued by the Lovech District Court’s criminal records bureau could not affect the lawfulness of his dismissal (see реш. № 1053 от 24.02.2014 г. по адм. д. № 9360/2013 г., АдмС-София-град).

14. The applicant appealed on points of law. He argued, inter alia, that the only proper way of ascertaining the existence of his penalty had been via data taken from the record card for the penalty, and that after the lawful destruction of that card owing to the expiry of the relevant time-limit (see paragraphs 17 and 38 below) it had been impermissible for those data to be obtained by other means.

15. On 11 February 2015 the Supreme Administrative Court upheld the lower court’s judgment. It held that by law, prison officers with substitute administrative penalties had to be dismissed (see paragraph 30 in fine below). It went on to say that the law did not require that the data about those penalties be obtained by the employer in any particular way. The applicant’s arguments in that regard were hence irrelevant. It was sufficient that there existed a criminal record report showing that he had been given such a penalty (реш. № 1532 от 11.02.2015 г. по адм. д. № 5112/2014 г., ВАС, V о.).

PROCEEDINGS RELATING TO THE DATA ABOUT THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY
1. Request for the deletion of the record card for the penalty

16. Apparently in reaction to the criminal record report issued on 14 August 2012 by the Lovech District Court’s criminal records bureau on the basis of the data obtained electronically from the Troyan District Court’s criminal records bureau (see paragraph 9 above), on 16 August 2012 the applicant asked the latter to destroy the record card for his substitute administrative penalty, noting that more than five years had elapsed since the judgment imposing that penalty had become final (see paragraph 38 below).

17. On 17 August 2012, the following day, the President of the Troyan District Court tasked a committee consisting of a judge and three court officials with destroying all record cards for substitute administrative penalties imposed by judgments which had become final more than five years previously. Basing itself on, inter alia, the regulation governing the time-limit for destroying such record cards (see paragraph 38 below), on 20 August 2012 that committee earmarked the card for the applicant’s penalty for destruction. Three months later, on 19 November 2012, the same committee earmarked all such cards whose five-year retention period had expired for destruction. On 5 December 2012 the State Archives Agency approved their destruction, and they were apparently destroyed shortly after that.

Complaint to the Commission for the Protection of Personal Data
1. Proceedings before the Commission

18. In the meantime, in November 2012 the applicant had complained to the Commission for the Protection of Personal Data (see paragraph 58 below) that the Ministry of Justice had processed his personal data unlawfully, since the Troyan District Court’s criminal records bureau had kept the record card for his penalty after October 2009, despite the expiry of the five-year period for its retention under the relevant regulation (see paragraph 38 below), and those data had then been used to prevent him from participating in the competition organised by the Ministry (see paragraph 9 above). The applicant urged the Commission to give directions for the breach of the relevant data protection requirements to cease and impose sanctions in relation to it. The Commission, on its own initiative, joined the Troyan District Court to the proceedings as a second respondent.

19. In its written submissions in response to the applicant’s complaint, the Ministry of Justice maintained, inter alia, that in accordance with a proper interpretation of the applicable regulations, the retention time-limit in one such regulation (see paragraph 38 below) concerned only the record cards themselves, not the data featuring in them.

20. The Commission heard the complaint on 4 June 2013. The applicant did not appear and was not represented. The Ministry of Justice was represented by in-house legal counsel and one of its data-processing officers. In response to a question by the Commission as to how the Ministry had been able to ascertain that the applicant had been given a substitute administrative penalty after the expiry of the five-year time-limit for keeping the record card for that penalty, the Ministry’s data-processing officer replied that the data did in fact still exist, and its counsel stated that the time-limit concerned only the cards themselves, not the data on them, which remained in the relevant database and were not subject to deletion after five years; they were to be retained indefinitely.

21. In June 2013 the Commission unanimously upheld the applicant’s complaint. It found that the retention of the data about his penalty by the Troyan District Court’s criminal records bureau after the expiry of the five-year period for keeping the record card for that penalty in October 2009 (see paragraph 38 below) had been in breach of section 2(2)(2) of the Protection of Personal Data Act 2002 (see paragraph 56 (b) below), which required that personal data be collected for specified, clearly defined and lawful purposes, and not processed additionally in a manner incompatible with those purposes. The retention of the data in issue after the expiry of the relevant time-limit had been devoid of any legal basis. The disclosure of such data to the Lovech District Court’s criminal records bureau in August 2012 (see paragraph 9 above) had thus also been unlawful. The Commission fined the Troyan District Court for those two breaches of the Act (see реш. № Ж-335/2012 от 26.06.2013 г., КЗЛД).

Proceedings for judicial review of the Commission’s decision

22. The Troyan District Court sought judicial review of the Commission’s decision.

23. Following the lodging of that judicial review claim, in July 2013 the applicant declared that he wished to withdraw his complaint to the Commission. He stated that he disagreed with the Commission’s findings against the Troyan District Court and had not directed his complaint against that court. The applicant did not appear and was not represented at the hearing before the Sofia City Administrative Court.

24. In its written submissions in support of the Troyan District Court’s claim, the Ministry of Justice reiterated that the time-limit for keeping the record cards for substitute administrative penalties only concerned the cards themselves, not the data on them, which were to be retained indefinitely. That was in line with a systematic reading of the relevant regulations – in particular those governing the alphabetical indexes and electronic archives kept by the competent criminal records bureaux – and the whole logic of the criminal records system as it had been set up.

25. In November 2013 the Sofia City Administrative Court found the Commission’s decision null and void on the basis that the Commission’s competence to give a decision in respect of the applicant’s complaint had disappeared with retrospective effect when he had withdrawn the complaint after the delivery of that decision (see реш. № 7373 от 26.11.2013 г. по адм. д. № 7597/2013 г., АдмС-София-град).

26. The Commission appealed on points of law. The applicant chose not to take part in the appeal proceedings either.

27. On 27 November 2014 the Supreme Administrative Court upheld the lower court’s judgment. It held that the Commission had erred by fining the Troyan District Court, since the applicant’s complaint had been directed solely against the Ministry of Justice. The Commission had also been wrong to find that the Troyan District Court had been processing the applicant’s data unlawfully. That court had been doing so for lawful purposes, in line with the relevant regulations (see paragraph 32 below), and had not retained the data in breach of a relevant time-limit. It was true that under the applicable regulation, a record card for a substitute administrative penalty was to be destroyed five years after the judgment imposing that penalty had become final (see paragraph 38 below). There was, however, no provision for the data from that card to be deleted as well; in accordance with another regulation (see paragraph 39 below), those data were to be retained in the alphabetical index and electronic archive kept by the competent criminal records bureau (see paragraphs 35-36 below). That was fully in line with Article 78a § 1 (b) of the Criminal Code, in accordance with which no one could benefit from a waiver of criminal liability more than once (see paragraph 29 below). The Troyan District Court had thus not acted in breach of section 2(2)(1) or (2)(1) of the Protection of Personal Data Act 2002 (see paragraph 56 (a) and (b) below). All those factors constituted grounds to quash the Commission’s decision, not to declare it null and void, but since the effects of those two ways of disposing of the case were identical, there was no reason to interfere with the lower court’s judgment (see реш. № 14179 от 27.11.2014 г. по адм. д. № 2069/2014 г., ВАС, V о.).

THE APPLICANT’S SUBSEQUENT EMPLOYMENT

28. In August 2015 the applicant started working for the National Revenue Service. He remained employed there, in various posts, until February 2023, when he took up a permanent post as a judicial assistant at the Lovech Regional Court, where he works to this day apparently.

RELEVANT LEGAL FRAMEWORK

SUBSTITUTE ADMINISTRATIVE PENALTIES

29. In some circumstances, Article 78a §§ 1 and 4 of the Criminal Code requires the courts to waive a convicted person’s criminal liability and replace it with administrative liability and therefore an administrative penalty (for details, see Genov and Sarbinska v. Bulgaria, no. 52358/15, § 41, 30 November 2021). In accordance with Article 78a § 1 (b), this can happen only once, but the former Supreme Court and the Supreme Court of Cassation have held that this may happen again if more than one year has passed since the execution of the previous substitute administrative penalty or since the expiry of the limitation period for its enforcement (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4, and тълк. реш. № 2 от 28.02.2018 г. по тълк. д. № 2/2017 г., ВКС, ОСНК, т. 7 и т. 8). The former Supreme Court has clarified that people who have been given such a substitute administrative penalty are not considered to have been criminally convicted, and that the provisions concerning rehabilitation do not concern them (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4).

30. Until mid-2014, people given such a penalty could not be employed as civil servants in the Ministry of Internal Affairs (section 179(1)(2) of the Ministry of Internal Affairs Act 2006, repealed in 2014, and its predecessor, section 193(1)(2) of the Ministry of Internal Affairs Act 1997). Accordingly, ascertaining the existence of such a penalty was grounds to dismiss a civil servant in that Ministry (section 245(1)(7)(e) of the 2006 Act). Under section 19(2) of the Execution of Punishments and Pre-Trial Detention Act 2009, employees of the Chief Directorate for the Execution of Punishments who are directly responsible for enforcement duties – such as prison guards – must, unless otherwise provided in the Act, meet the appointment requirements of the Ministry of Internal Affairs Act. Until mid-2014, people given such a penalty could therefore not serve in such posts either.

31. People given such a penalty in respect of a wilful offence cannot be

(a) officers in the State Agency for National Security (section 53(1)(4) of the State Agency for National Security Act 2007);

(b) officers in the National Security Service (section 39(3)(1) of the National Security Service Act 2015);

(c) forest guards (section 198(2)(2) of the Forests Act 2011), ski patrolmen (regulation 25(2)(2) of the 2015 Regulations for the safety of ski slopes);

(d) head or deputy head of the State Intelligence Agency (section 15(1)(4) of the State Intelligence Agency Act 2015);

(e) head or deputy head of the Military Intelligence Service (section 26(1)(4) of the Military Intelligence Act 2015);

(f) head or deputy head of the Technical Operations Agency attached to the Council of Ministers (section 19c(4)(4) of the Special Surveillance Means Act 1997);

(g) head of the National Protection Service (section 8(2)(4) of the National Protection Service Act 2015);

(h) members of the Commission for the Forfeiture of Proceeds of Crime (section 10(1)(1) of the Forfeiture of Proceeds of Crime Act 2018);

(i) members of the Commission for the Prevention of Corruption (section 10(1)(1) of the Prevention of Corruption Act 2023);

(j) members of the Central Electoral Commission or a regional or municipal electoral commission (Article 50 § 3 (1), Article 65 § 3 and Article 80 § 3 of the 2014 Electoral Code); or

(k) elected members of the Supreme Judicial Council (section 18(1)(8) of the Judiciary Act 2007).

RETENTION AND DISCLOSURE OF CRIMINAL RECORDS
1. Regulations governing those matters

32. Since March 2008 the retention and disclosure of data about convictions and substitute administrative penalties (see paragraph 29 above) have been governed by Regulations no. 8 of 2008 of the Minister of Justice (Наредба № 8 от 26.02.2008 г. за функциите и организацията на дейността на бюрата за съдимост). Those Regulations were amended in various respects in February 2013, July 2014, October 2015, February 2018, July and December 2020, December 2021, and August 2022. Before March 2008 those matters were governed by Regulations no. 1 of 2000 of the Minister of Justice (and before that, by Regulations no. 466 of 1975 and then by Regulations no. 1 of 1986 of the Minister of Justice).

Authority tasked with retaining and disclosing criminal records

33. Under Regulations no. 8 of 2008, there is a criminal records bureau attached to each district court, plus a central criminal records bureau attached to the Ministry of Justice (regulations 1-3; see also section 77(3) and (4) of the Judiciary Act 2007). Each district bureau retains criminal records and makes them available, including records about people born in the respective judicial district who have been convicted or given a substitute administrative penalty by the Bulgarian courts (regulation 2(1) and (2), amended in December 2021 to become regulation 2(1)(1) and (1)(2)).

34. The exchange of information with foreign criminal records authorities is carried out by the central criminal records bureau and is governed by special rules, in particular as regards the exchange of information with other member States of the European Union (see footnote 6 below). Apart from in the context of this type of exchange, the criminal records bureaux can only disclose someone’s criminal record in one of two ways: (a) by issuing a conviction certificate following a request by the person concerned or a relative of that person (since September 2022 it has also been possible for some authorities to obtain such certificates directly, in electronic form); or (b) by issuing a criminal record report at the request of an authority entitled to obtain such a report (see paragraph 46 (a) and (b) below).

Periods for the retention of criminal records

35. Criminal records are kept in the form of (a) conviction record cards (regulations 6-25), and (b) record cards for substitute administrative penalties (regulations 26-32). Until the end of 2021 those record cards existed in paper form only, with an electronic archive of the paper original (regulations 5(1), 8(2), 13(1) and 27(1), as worded until the end of 2021). Since the beginning of 2022 it has been necessary to keep the cards in both electronic and paper form, the paper form consisting of a printout of the electronic record (regulations 5(1), 8(2) and (3), 13(1) and 27(1)-(3), as worded since the beginning of 2022).

36. Each criminal records bureau must also keep an alphabetical index and an incoming register of all record cards which it has received; the index has both a paper and an electronic version (regulations 5(2), 13(1) and 28(1)). Regulation 28(1)(2), as worded initially in 2008 (and until the end of 2020), specified that the alphabetical index concerning record cards for substitute administrative penalties had to contain (a) the date and number of the respective judgment, (b) the date on which it had become final, and (c) the name of the court which had handed it down.

Conviction record cards

37. A conviction record card must be destroyed one hundred years after the person whom it concerns has been born (regulation 24(1)).[1] The earmarking of a card for destruction is to be recorded in the alphabetical index (see paragraph 36 above), without erasing the names of the people concerned and the related data from the index itself (regulation 24(2)). Under regulation 24(1) in fine, as worded until the end of 2021, the cards were to be microfilmed before their destruction. The amending regulations, issued in July 2020, did not say what was to become of all existing microfilms. In a series of judgments given in 2015-19 in cases concerning police registration, the Supreme Administrative Court stated, obiter, that the destruction of conviction record cards in accordance with regulation 24(1) did not entail the deletion of the data that they contained (see реш. № 7769 от 26.06.2015 г. по адм. д. № 13082/2014 г., ВАС, V о.; реш. № 12582 от 24.11.2015 г. по адм. д. № 4683/2015 г., ВАС, V о.; реш. № 12775 от 27.11.2015 г. по адм. д. № 15330/2014 г., ВАС, V о.; реш. № 5563 от 11.05.2016 г. по адм. д. № 4687/2015 г., ВАС, V о.; реш. № 7180 от 15.06.2016 г. по адм. д. № 7040/2015 г., ВАС, V о.; реш. № 10799 от 17.10.2016 г. по адм. д. № 7455/2015 г., ВАС, V о.; реш. № 13136 от 05.12.2016 г. по адм. д. № 10757/2015 г., ВАС, V о.; реш. № 13606 от 13.12.2016 г. по адм. д. № 10389/2015 г., ВАС, V о.; реш. № 1562 от 07.02.2017 г. по адм. д. № 12908/2015 г., ВАС, V о.; реш. № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о.; реш. № 15447 от 15.12.2017 г. по адм. д. № 4813/2017 г., ВАС, V о.; реш. № 4156 от 30.03.2018 г. по адм. д. № 4191/2016 г., ВАС, V о.; and опр. № 7233 от 15.05.2019 г. по адм. д. № 4329/2019 г., ВАС, V о.). In five of those judgments, given in 2016-18 (реш. № 7180 от 15.06.2016 г. по адм. д. № 7040/2015 г., ВАС, V о.; реш. № 1562 от 07.02.2017 г. по адм. д. № 12908/2015 г., ВАС, V о.; реш. № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о.; реш. № 15447 от 15.12.2017 г. по адм. д. № 4813/2017 г., ВАС, V о.; and реш. № 4156 от 30.03.2018 г. по адм. д. № 4191/2016 г., ВАС, V о.), the court went on to note that it could not assess whether Bulgarian law was in line with the requirements of Directive (EU) 2016/680 (see paragraphs 61 and 73-74 below), since that Directive had not yet been transposed and the deadline for its transposition had not yet expired (see paragraph 62 below).

Record cards for substitute administrative penalties

38. Under regulation 31(1), as worded initially in 2008, a record card for a substitute administrative penalty was to be destroyed five years after the judgments imposing the penalty had become final.[2] An amendment which came into force in February 2013 extended that five-year period to fifteen years. In contrast to the position with respect to conviction record cards (see paragraph 37 above), the regulations did not prescribe that record cards for substitute administrative penalties were to be microfilmed before their destruction.[3]

39. As with the destruction of conviction record cards, the earmarking of a card for destruction is to be recorded in the alphabetical index (see paragraph 36 above), without erasing the names of the people concerned and the related data from the index itself (regulation 28(3), inserted with effect from February 2013).

40. The extension of the retention period for record cards for substitute administrative penalties from five to fifteen years threw up the question of what was to become of cards which ought to have been destroyed owing to the expiry of the five-year period before the entry into force of the amendment extending it to fifteen years.

41. In February 2014 the Supreme Judicial Council’s legal affairs committee resolved that cards whose five-year retention period had already expired by the time the amendment had come into force in February 2013 were to be destroyed, and those whose five-year retention period had not expired by that time were to be kept for fifteen years after their creation.

42. The question then arose as to what was to become of (a) the electronic archives of the record cards due for destruction and (b) the data taken from those cards and entered into the alphabetical indexes and incoming registers kept by the criminal records bureaux (see paragraphs 35-36 above). The Supreme Judicial Council’s legal affairs committee sought an opinion on the point from the Commission for the Protection of Personal Data. In that opinion (Становище № П-2737 от 28.07.2014 г.), given in July 2014, the Commission noted that the position of the Ministry of Justice was that the correct construction of regulation 28(3) (see paragraph 39 above) was that it required that the data taken from the record cards be retained indefinitely (unlike the cards themselves), inter alia, for the purpose of checking whether the people concerned were to be disqualified from holding certain public-sector posts. In the Commission’s view, such indefinite retention ran counter to the basic data protection principles set out in section 2(2) of the Protection of Personal Data Act 2002 (see paragraph 56 below), the proper protection of the private lives of those concerned, and the relevant international data protection standards. According to the Commission, the correct construction of regulation 31(1) (see paragraph 38 above) was that it required that the data taken from the record cards be deleted along with the cards themselves; this was the Commission’s settled position on the point.

43. For its part, in four nearly identically reasoned judgments given in 2014-16 (the first of which was that delivered in the applicant’s case – see paragraph 27 above), the Supreme Administrative Court held that even when the five-year period for storing record cards for substitute administrative penalties had expired, the electronic data from them were not subject to deletion, since they were to be kept in the alphabetical indexes and electronic archives of the criminal records bureaux (see paragraphs 35-36 above). In the court’s view, that was fully in line with Article 78a § 1 (b) of the Criminal Code (see paragraph 29 above), in accordance with which no one could benefit from a waiver of criminal liability more than once (see реш. № 14179 от 27.11.2014 г. по адм. Д. № 2069/2014 г., ВАС, V о.; реш. № 4204 от 16.04.2015 г. по адм. Д. № 9350/2014 г., ВАС, V о.; реш. № 4355 от 13.04.2016 г. по адм. Д. № 3879/2015 г., ВАС, V о.; and реш. № 6695 от 06.06.2016 г. по адм. Д. № 5685/2015 г., ВАС, V о.).

Data records about the criminal history of third-country nationals

44. A new regulation 50e, which was added in December 2021 and came into force in September 2022, provides for the creation of a data record in the European Criminal Records Information System on Third-Country Nationals (ECRIS-TCN)[4] in relation to any person who has been criminally convicted or given a substitute administrative penalty in Bulgaria and is (a) a national of a State which is not a member State of the European Union (EU), (b) a national of both an EU member State and a non-member State, or (c) a stateless person or a person whose nationality is unknown. Such data records must be created even for convictions pre-dating the start of data entry into the ECRIS-TCN (regulation 50e(4)).

45. In accordance with regulation 50f(1) and (2), also added in December 2021 and in force since September 2022, read in conjunction with regulations 24(1) and 31(1), such a data record must be deleted when the time-limit for the destruction of the respective conviction record card has expired (one hundred years after the birth of the people concerned – see paragraph 37 above), or when the time-limit for the destruction of the respective record card for a substitute administrative penalty has expired (fifteen years after the judgment imposing the penalty has become final – see paragraph 38 above).[5]

Manner of disclosing criminal records

46. Under regulations 4(1) and 33, a district court’s criminal records bureau can disclose someone’s criminal record in one of two ways.[6]

(a) By issuing a conviction certificate (свидетелство за съдимост) following a request by the person to whom the criminal record relates or by certain relatives of that person (regulation 33(2)-(4)). Since September 2022 it has also been possible for some authorities to obtain such certificates directly, in electronic form (електронно свидетелство за съдимост), when by law they have to check someone’s criminal record (new regulation 35b, in force since September 2022).

(b) By issuing a criminal record report (справка за съдимост). Such a report can only be sought for official purposes by the authorities empowered to do so (regulation 33(5)). Those authorities are

(i) the criminal courts, prosecutor’s offices and investigating authorities (regulation 33(5)(1));

(ii) the various security services tasked with vetting people for the purpose of giving them clearance to access classified information (regulation 33(5)(2));

(iii) other State authorities or bodies authorised by law to obtain such data (regulation 33(5)(3));

(iv) foreign judicial authorities, if that is prescribed by a treaty or by EU law (regulation 33(5)(4));

(v) the central criminal record authorities of other EU member States (regulation 33(5)(5));

(vi) foreign diplomatic or consular missions, in respect of nationals of their own States (regulation 33(5)(6));

(vii) (since an October 2015 amendment) the Central Electoral Commission, in respect of parliamentary candidates for the Bulgarian Parliament and the European Parliament, and candidates for President and Vice-President of the Republic, municipal councillors and mayors (regulation 33(5)(7)); and

(viii) foreign diplomatic or consular missions, in respect of Bulgarian nationals, when necessary for official purposes (regulation 46(2)).

47. A conviction certificate only contains data about convictions (regulation 39(1)). It must moreover not mention any convictions for offences in respect of which the person concerned has been rehabilitated (is no longer considered to have been convicted) (regulation 39(2)(2)), unless a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, but in that case the certificate must specifically mention that the person concerned has been rehabilitated and set out the date when he or she was considered to have been rehabilitated (regulation 39(3)).

48. A criminal record report contains data about both convictions and substitute administrative penalties (regulation 40(1)). It must mention all convictions, irrespective of rehabilitation (regulation 36(2)).

RELEVANT DATA PROTECTION PROVISIONS
1. Provisions as they stood between the time when Bulgaria acceded to the EU (1 January 2007) and the entry into force of the General Data Protection Regulation in May 2018 and the transposition of Directive (EU) 2016/680 into Bulgarian law in March 2019

49. As noted in the explanatory notes to the government bill which led to its enactment (no. 102-01-7), the Protection of Personal Data Act 2002 (“the 2002 Act”) was enacted in anticipation of the ratification by Bulgaria of the Council of Europe’s 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (see paragraph 77 below).

50. Bulgaria had signed that Convention in 1998 and ratified it in 2002, and it came into force with respect to Bulgaria on 1 January 2003. The Convention’s translation into Bulgarian was published in the Bulgarian State Gazette on 21 March 2003 (ДВ, бр. 26 от 21.03.2003 г., стр. 58-63). It is accordingly part of Bulgarian domestic law and takes precedence over any conflicting provisions of domestic legislation (Article 5 § 4 of the 1991 Constitution).

Scope of application

51. In November 2006 section 1(3) of the 2002 Act was amended to specify that the Act would apply to all processing of personal data by automatic means, and to all processing otherwise than by automatic means of personal data which formed part of a filing system or were intended to form part of a filing system.

52. The explanatory notes to the government bill (no. 602-01-83) which led to that amendment stated that all proposed amendments were required to bring the 2002 Act fully in line [7] with EU data protection law, particularly as regards the scope of application of the Act, in view of Bulgaria’s impending accession to the EU (which took place on 1 January 2007). The text of section 1(3) of the Act, as amended at that time, reflected nearly verbatim the text of Article 3 § 1 of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which was still in force at that time.

53. Article 8 § 5 of Directive 95/46/EC governed specifically the processing of data relating to, inter alia, “offences” and “criminal convictions”.

54. With the same 2006 amendment, section 1(5) of the 2002 Act was amended to provide that, unless otherwise stipulated in special legislation, the Act would also apply to the processing of personal data for the purposes of, inter alia, criminal proceedings. Section 1(4) of the 2002 Act, as worded before the amendment, excluded the processing of personal data for the purposes of criminal proceedings from the scope of application of the Act.

55. In October 2011 section 1(5) of the 2002 Act was amended further (along with a number of other provisions of the Act) to specify that unless otherwise provided in special legislation, the Act would apply to the processing of personal data for the purposes of, inter alia, (a) safeguarding public order and combating crime, (b) criminal proceedings, and (c) the execution of criminal penalties. Paragraph 15 of the amending Act specified that the amendments transposed Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, which was still in force at that time.

Principles relating to the processing of personal data

56. Under section 2(2) of the 2002 Act, as worded after a December 2005 amendment, personal data had to be, inter alia,

(a) processed lawfully and fairly (subsection 2(2)(1));

(b) collected for specified, clearly defined and lawful purposes, and not processed additionally in a manner incompatible with those purposes (subsection 2(2)(2)); and

(c) kept in a form which permitted identification of the respective natural persons for a period no longer than necessary, for the purposes for which those data were processed (subsection 2(2)(6)).

57. The explanatory notes to the government bill (no. 502-01-28) which led to the December 2005 amendments stated that those were necessary to bring the 2002 Act fully in line with EU data protection law, in view of Bulgaria’s impending accession to the EU. The wording of section 2(2) of the Act reflected nearly verbatim the wording of Article 6 § 1 of Directive 95/46/EC (see paragraph 49 above).[8]

Remedies in respect of allegedly unlawful data processing

58. While the proceedings relating to the data about the applicant’s penalty were taking place before the Commission for the Protection of Personal Data and then the administrative courts (see paragraphs 18-27 above), and until March 2019, section 38(1) of the 2002 Act provided that anyone could complain to that Commission of a breach of his or her rights under the Act. The Commission’s powers in such proceedings were to (a) give directions to the data controller, (b) fix a time-limit for the breach to be put right, and (c) impose an administrative penalty (section 38(2), as worded until March 2019). In cases concerning the processing of personal data for the purposes of national defence, national security, public order or criminal proceedings, the Commission’s powers were limited to declaring whether the processing was lawful (section 38(5), currently section 38(6)). The Supreme Administrative Court has held that in such cases, the Commission cannot prescribe any remedial measures, and a case is to be referred back to the relevant authority for it to decide how to proceed, on the basis of the Commission’s findings (see реш. № 13202 от 03.12.2008 г. по адм. д. № 10153/2008 г., ВАС, петчл. с-в). At the material time, section 38 of the 2002 Act also provided that the Commission’s decision was amenable to judicial review (section 38(6), currently section 38(7)).

59. Alternatively, aggrieved individuals could seek judicial review of the data controller’s decisions or actions, plus damages (section 39(1) and (2), as worded until March 2019). If the person concerned had turned to the Commission for the Protection of Personal Data, that remedial avenue could not be used until the proceedings before the Commission (and any proceedings for judicial review of its decision) had ended (section 39(4), as worded until March 2019).

Provisions as they have been since the entry into force of the General Data Protection Regulation in May 2018 and the transposition of Directive (EU) 2016/680 into Bulgarian law in March 2019

60. In accordance with Article 99 § 2 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation – “the GDPR”), which is directly applicable in all EU member States, the GDPR applies from 25 May 2018. It repealed Directive 95/46/EC (see paragraph 52 in fine above) with effect from the same date (Article 94 § 1 of the GDPR).

61. The GDPR was adopted alongside a more specific EU legal instrument which governs the processing of personal data by the authorities for law-enforcement purposes – Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data (“the Law-Enforcement Directive” – “the LED”). In accordance with Article 63 § 1 of the LED, the Directive was to be transposed by 6 May 2018, and in accordance with Article 59 § 1, it repealed Framework Decision 2008/977/JHA with effect from the same date (see paragraph 55 in fine above).

62. Bulgaria transposed the LED, chiefly by way of amendments to the 2002 Act which came into force in March 2019. Those amendments also brought the 2002 Act in line with the GDPR.

Scope of application

63. In accordance with Article 2 § 2 (d) of the GDPR, the regulation does not apply to the processing of personal data “by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”. As explained in recital 19 of the GDPR, that sort of processing is instead governed by the LED (see judgment of the Court of Justice of the European Union (CJEU) of 22 June 2021 in Latvijas Republikas Saeima (Penalty points), C-439/19, EU:C:2021:504, paragraph 69). Under Article 2 § 1 read in conjunction with Article 1 § 1 of the LED, the processing of personal data by competent authorities for all those purposes accordingly falls within the LED’s scope of application. “Competent authority” is defined in Article 3 § 7 of the LED, and the same definition is applied to Article 2 § 2 (d) of the GDPR (ibid.).

64. Article 1 § 1 and Article 2 § 1 of the LED were transposed by section 1(2) of the 2002 Act, as amended with effect from March 2019.

65. Recital 19 in fine of the GDPR and recital 11 of the LED specify that if a law-enforcement authority or a court processes personal data for purposes other than the law-enforcement purposes covered by the LED, that sort of processing is governed by the GDPR.

66. For instance, as made plain by Article 10 of the GDPR (which superseded Article 8 § 5 of Directive 95/46/EC – see paragraph 53 above and paragraph 70 below; see also judgment of the CJEU of 24 September 2019 in GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraph 41), the regulation applies to the processing of personal data relating to criminal convictions and offences.

Principles relating to the processing of personal data

(a) Processing falling within the scope of the GDPR

67. The amendments to the 2002 Act transposing the LED and bringing Bulgarian law in line with the GDPR (see paragraph 62 above) repealed section 2(2) of the Act (see paragraph 56 above), since in so far as the processing of personal data falling within the scope of the GDPR is concerned, the Act now only governs matters not addressed by the GDPR itself (section 1(1) of the Act, as amended in early 2019).

68. The principles relating to the processing of personal data in Bulgaria falling within the scope of the GDPR are thus now those set out in Article 5 §§ 1 and 2 of the GDPR itself. In accordance with that provision, those include the requirements that personal data be

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency” – Article 5 § 1 (a));

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation” – Article 5 § 1 (b)); and

(c) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (“storage limitation” – Article 5 § 1 (e)).

69. The CJEU has clarified that the principles set out in that Article also apply to the processing of personal data relating to criminal convictions and offences (see Latvijas Republikas Saeima (Penalty points), cited in paragraph 63 above, paragraphs 96 and 104 in fine). It has also noted that those principles apply cumulatively, and that any such processing must therefore comply with all of them (see judgment of the CJEU of 20 October 2022 in Digi, C-77/21, EU:C:2022:805, paragraph 47).

(b) Processing of criminal record data falling within the scope of the GDPR

70. Article 10 of the GDPR requires, inter alia, that the “processing of personal data relating to criminal convictions and offences ... be carried out only under the control of official authority or when the processing is authorised by EU or member-State law providing for appropriate safeguards for the rights and freedoms of data subjects”.

71. The CJEU has noted that this provision is intended to ensure enhanced protection in respect of processing which, owing to the particular sensitivity of the data at issue, which can lead to social disapproval and stigmatise the data subject, can amount to a particularly serious interference with the right to respect for private life (see Latvijas Republikas Saeima (Penalty points), cited in paragraph 63 above, paragraphs 74-75).

72. The CJEU has also clarified that although this provision applies only to data relating to “criminal offences”, not administrative sanctions, the autonomous meaning of that term also covers road traffic offences, even when they are classified as administrative in the national law of the State concerned (ibid., paragraphs 77-93).

73. The processing of personal data for purposes falling under the LED is governed by section 45(1) of the 2002 Act, as amended in early 2019, which transposed Article 4 § 1 of the LED. That provision requires that personal data be, inter alia,

(a) processed lawfully and fairly (section 45(1)(1) – see also, on this point, Article 4 § 1 (a) of the LED and its recital 26);

(b) collected for specified, explicit and lawful purposes and not processed in a manner that is incompatible with those purposes (section 45(1)(2) – see also, on this point, Article 4 § 1 (b) of the LED and its recital 29); and

(c) kept in a form which permits identification of the data subject for a period no longer than necessary for the purposes for which they are processed (section 45(1)(5) – see also, on this point, Article 4 § 1 (e) of the LED and its recital 26 in fine, as well as judgment of the CJEU of 30 January 2024 in Direktor na Glavna direktsia „Natsionalna politsia“ pri MVR-Sofia, C-118/22, EU:C:2024:97, paragraphs 43, 45 and 60 in fine).

74. Section 46(1) of the 2002 Act, as amended in early 2019, which transposed Article 5 of the LED (see also recital 26 in fine of the LED, and Direktor na Glavna direktsia „Natsionalna politsia“ pri MVR-Sofia, cited in paragraph 73 (c) above, paragraphs 44, 68 and 70), provides that when the time-limits for the deletion of personal data or for a periodic review of the need for their storage have not been fixed by law or regulation, they must be fixed by the data controller. Section 46(2) goes on to specify that any such periodic review has to be documented, and that reasons have to be given for any decision to keep storing the data.

Remedies in respect of allegedly unlawful data processing

75. In March 2019, when the 2002 Act was brought in line with the GDPR and the LED, the earlier system of remedies (see paragraphs 58-59 above) was kept, except with respect to data processing by the courts and the prosecuting and investigating authorities for law-enforcement purposes. The only change was that the powers of the Commission for the Protection of Personal Data were harmonised with Article 58 § 2 (a)-(h) and (j) of the GDPR (sections 38(3) and 82(1) of the Act, as worded since March 2019).

76. Since March 2019 the administrative remedy in respect of data processing by the authorities for law-enforcement purposes has been a complaint to the Inspectorate attached to the Supreme Judicial Council (sections 38b(1) and 82(1), as worded since March 2019). The judicial remedy remains a claim for judicial review of the data controller’s or data processor’s decisions or actions, possibly coupled with a claim for damages (sections 39(1) and (2) and 82(1), as worded since March 2019). The bar on parallel proceedings before the Commission for the Protection of Personal Data or the Inspectorate (and any proceedings for judicial review of their decisions) and judicial review proceedings against the data controller remained (section 39(4) and (5), as worded since March 2019).

RELEVANT COUNCIL OF EUROPE MATERIAL

77. In accordance with Article 5 (e) of the Council of Europe’s 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108; 1496 UNTS 65), personal data undergoing automatic processing have to be “preserved in a form which permits identification of the data subjects for no longer than is required for the purpose for which those data are stored”.

RELEVANT STATISTICAL DATA

78. According to data published by the National Statistical Institute,[9] 3,273 people were given substitute administrative penalties under Article 78a of the Criminal Code (see paragraph 29 above) in 2022.

79. According to data published by the Ministry of Internal Affairs in January 2015,[10] about 41,000 people were occupying civil-servant posts in that Ministry in December 2014.

THE LAW

ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION

80. The applicant complained under Article 8 of the Convention about the retention of the data related to his substitute administrative penalty and the actual and potential disclosure of those data. That provision reads, so far as relevant:

“1. Everyone has the right to respect for his private ... life ...

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

Scope of the complaint

81. The applicant applied to the Court in August 2015 following data about his substitute administrative penalty actually being disclosed. However, a thorough reading of his application and his observations filed in June 2023 shows that, though chiefly aggrieved by the actual disclosure of those data in 2012-13 (which had resulted in his dismissal), he was also aggrieved by the (alleged) ongoing retention of those data, and that his complaint under Article 8 of the Convention relates to both grievances. That (alleged) ongoing retention is hence within the scope of the case that he referred to the Court in the exercise of his right of individual application (compare, mutatis mutandis, S.M. v. Croatia [GC], no. 60561/14, § 225, 25 June 2020, and Yüksel Yalçınkaya v. Türkiye [GC], no. 15669/20, §§ 279-80, 26 September 2023, and contrast, mutatis mutandis, Radomilja and Others v. Croatia [GC], nos. 37685/10 and 22768/12, §§ 128-30, 20 March 2018, and NIT S.R.L. v. the Republic of Moldova [GC], no. 28470/12, §§ 144-45, 5 April 2022).

Admissibility
1. Exhaustion of domestic remedies and compliance with the six-month time-limit

(i) Exhaustion of domestic remedies

82. The Government submitted that the proceedings for judicial review of the applicant’s dismissal had concerned his employment, and had not been a remedy in respect of the retention of data about his penalty. The courts hearing that case had clearly differentiated between the lawfulness of the dismissal and any issues relating to the applicant’s criminal record. The remedy in respect of the retention of the data in issue had instead been the proceedings before the Commission for the Protection of Personal Data. Although that case had reached the Supreme Administrative Court, the applicant had, for unclear reasons, withdrawn his complaint to the Commission, thus retrospectively invalidating its decision, and subsequently had not taken part in the proceedings for judicial review of that decision. He had thus failed to pursue his grievance all the way up through the appropriate domestic legal channels, and hence to exhaust domestic remedies.

83. The applicant pointed out that although he had withdrawn his complaint to the Commission for the Protection of Personal Data, the Supreme Administrative Court had examined the case on the merits and had analysed the arguments which he had put before the Commission. The withdrawal of his complaint could not therefore be seen as a failure to exhaust domestic remedies. All that was in any event irrelevant, since those proceedings had not been a remedy in respect of his complaint under Article 8 of the Convention; the real remedy in respect of that complaint had been the proceedings for judicial review of his dismissal.

(ii) Compliance with the six-month time-limit

84. The Government submitted that the judgment in which the Supreme Administrative Court had upheld the applicant’s dismissal with final effect had not been the “final decision” in respect of the complaint which he had then raised before the Court. Those proceedings had concerned the applicant’s employment, not the retention of the data about his penalty. The remedy in respect of that retention had been the proceedings before the Commission for the Protection of Personal Data, which had ended more than six months before the applicant had applied to the Court.

85. The applicant submitted that the subject matter of the proceedings in which he had challenged his dismissal had been inextricably linked to the complaint that he had then raised before the Court. That dismissal had resulted solely from the unjustified retention and disclosure of the data about his penalty. The outcome of those proceedings had thus been important as regards the extent of the damage flowing from the alleged breach of Article 8 of the Convention, and it had been necessary to await that outcome to ascertain the magnitude of the breach before turning to the Court. Moreover, when ruling on his dismissal, the Supreme Administrative Court had independently analysed the lawfulness of retaining the data about the penalty, without deferring to its earlier findings in the case concerning the retention itself. It followed that the only proceedings capable of effectively protecting the applicant’s rights under Article 8 had been those in which he had challenged his dismissal, and that the “final decision” had been the one given by the Supreme Administrative Court in that case.

(ii) Alleged ongoing retention and ensuing risk of disclosure

86. On the facts of this case, the questions of whether domestic remedies have been exhausted and whether the six-month time-limit (applicable prior to the entry into force of Protocol No. 15 to the Convention on 1 August 2021, which reduced it to four months) has been complied with are inextricably linked, and must be examined together.

87. Indeed, those two requirements are in general closely intertwined (see, among other authorities, Jeronovičs v. Latvia [GC], no. 44898/10, § 75, 5 July 2016). Not only do they feature in the same provision, but they are set out in a single sentence whose grammatical construction implies such a correlation (see, among other authorities, Lopes de Sousa Fernandes v. Portugal [GC], no. 56080/13, § 130, 19 December 2017; Savickis and Others v. Latvia [GC], no. 49270/11, § 131, 9 June 2022; and Ukraine and the Netherlands v. Russia (dec.) [GC], nos. 8019/16 and 2 others, § 776, 30 November 2022). Accordingly, the time‑limit under Article 35 § 1 normally starts to run from the “final decision” resulting from the exhaustion of remedies capable of adequately and effectively redressing the matter complained of (see, among other authorities, Nikolova and Velichkova v. Bulgaria (dec.), no. 7888/03, 13 March 2007; Dzhabarov and Others v. Bulgaria, nos. 6095/11 and 2 others, § 57, 31 March 2016; D.H. and Others v. North Macedonia, no. 44033/17, § 28, 18 July 2023; and Dragan Petrović v. Serbia, no. 75229/10, § 50, 14 April 2020).

88. In the present case, compliance with those two admissibility criteria needs to be assessed separately with respect to (a) the actual disclosure in 2012-13 of the data about the applicant’s penalty to the authority which was employing him (see paragraphs 9-11 above), and (b) the (alleged) ongoing retention of those data and the resulting risk of the data being disclosed (see D.S. v. the United Kingdom, no. 70988/12, §§ 22-23, 30 March 2021, and M.C. v. the United Kingdom, no. 51220/13, § 36-38, 30 March 2021, and, mutatis mutandis, L.B. v. Hungary [GC], no. 36345/16, § 58, 9 March 2023). The former consisted of one-off acts, whereas the latter amounts to a continuing situation (see Hilton v. the United Kingdom, no. 12015/86, Commission decision of 6 July 1988, Decisions and Reports (DR) 57, p. 108, at p. 114, and M.M. v. the United Kingdom, no. 24029/07, §§ 160 and 172, 13 November 2012). An examination of the application form shows that the applicant complained not only of the actual disclosure, but also of the ongoing retention of those data (see paragraph 81 above, and contrast Aramov v. Bulgaria (dec.), no. 28649/03, 12 June 2012).

(i) The actual disclosure

89. The proceedings in which the applicant challenged his dismissal (see paragraphs 12-15 above) were not a remedy in respect of the data retention and disclosure which led to that dismissal, and cannot be taken into account when assessing exhaustion or compliance with the six-month time-limit in respect of the applicant’s complaint about that data retention and disclosure (see, mutatis mutandis, M.C. v. the United Kingdom, cited above, § 37). It is true that in those proceedings he put forward arguments about the lawfulness of retaining the data, and that the courts engaged with those arguments. It nonetheless remains the case that the proceedings did not challenge the retention or disclosure of the data as such, and could not result in any redress relating to the data themselves; the aim of the proceedings was purely to protect the applicant’s job. They were hence not a remedy in respect of the complaint under Article 8 of the Convention which the applicant then raised before the Court (see Leander v. Sweden, no. 9248/81, Commission decision of 10 October 1983, DR 34, p. 78, at p. 85 in fine, and M.M. v. the United Kingdom, cited above, § 161). A remedy relating to retained data is normally effective only if it can lead to their deletion or rectification (see Kamburov v. Bulgaria (dec.), no. 14336/05, § 56, 6 June 2006) or at least, in some circumstances, to a situation where such data cannot be disclosed (see M.M. v. the United Kingdom, cited above, § 159, and A.S. v. the United Kingdom (dec.), no. 22189/10, 11 March 2014).

90. By contrast, the proceedings resulting from the applicant’s complaint to the Commission for the Protection of Personal Data (see paragraphs 18-27 above) can be seen as a remedy which could redress his grievance in relation to the disclosure of the data. In such proceedings, the Commission could give directions to the data controller, fix a time-limit for the breach to be put right, and impose an administrative penalty (see paragraph 58 above). In the proceedings brought by the applicant, the Commission found that the retention of the data after October 2009 and their resulting disclosure had been unlawful, and fined the Troyan District Court for those two breaches of the relevant data protection requirements (see paragraph 21 above).

91. The question is whether the applicant duly exhausted that remedy. It cannot be overlooked that after the Commission had given its decision in respect of his complaint and the respondent authority (the Troyan District Court) had sought judicial review of that decision, the applicant – who was party to those judicial review proceedings (see paragraph 23 above) – withdrew his complaint to the Commission, thus causing the Sofia City Administrative Court to declare the Commission’s decision null and void on the basis that the withdrawal of the complaint had retrospectively deprived the Commission of its competence to give a decision in that regard (see paragraphs 22-25 above). However, when the case then came before the Supreme Administrative Court following an appeal by the Commission itself (the applicant chose not to take part in those proceedings), that court went on to analyse the merits of the case and to hold that the data in question had not been processed unlawfully, since the electronic version of the data was to be kept indefinitely (see paragraphs 26-27 above). Indeed, that court maintained that position in all of its subsequent judgments dealing with the point (see paragraph 43 above). Nothing suggests that the Supreme Administrative Court would have ruled otherwise if the applicant had taken part in the proceedings before it.

92. In those circumstances, the complaint cannot be rejected for failure to exhaust domestic remedies. Non-exhaustion of domestic remedies cannot be held against an applicant if, despite his or her failure to bring the case before the competent national court in line with the relevant procedural requirements, that court has examined the substance of his or her complaint (see, among other authorities, Öztürk v. Turkey [GC], no. 22479/93, §§ 45-46, ECHR 1999‑VI; Gäfgen v. Germany [GC], no. 22978/05, § 143, ECHR 2010; and Savickis and Others, cited above, §§ 140 and 152).

93. However, the other consequence of the above analysis is that the “final decision” in respect of the applicant’s complaint concerning the actual disclosure of the data about his penalty was the judgment given by the Supreme Administrative Court on 27 November 2014. Since the applicant lodged his application with the Court on 10 August 2015, more than eight months after that judgment, this complaint must be rejected for failure to comply with the six-month time-limit under Article 35 § 1 of the Convention.

94. Although the applicant did not direct his complaint made to the Commission for the Protection of Personal Data against the Troyan District Court, where the record card for his substitute administrative penalty had been kept, it can be accepted that this complaint also concerned the ongoing retention of the data about that penalty (see paragraph 18 above). It is also true that he then retrospectively withdrew that complaint and took no part in the judicial review proceedings in which the Commission’s decision was challenged by the Troyan District Court (see paragraphs 22-27 above). Nor did he try the alternative remedy – seeking judicial review of the data controller’s actions and possibly damages (see paragraph 59 above). However, in the light of the Supreme Administrative Court’s ruling, in the proceedings against the Commission’s decision, that the processing of data about the applicant’s penalty was lawful – a position which that court fully maintained in all of its subsequent judgments on the point (see paragraphs 27 and 43 above) – it would have been futile for the applicant to pursue the first of those remedies to conclusion or attempt the second. It follows that in so far as his complaint concerns the alleged ongoing retention of the data about his penalty, it cannot be rejected for failure to exhaust domestic remedies. Applicants do not have to pursue remedies which do not offer a reasonable prospect of success (see, as a recent authority, Communauté genevoise d’action syndicale (CGAS) v. Switzerland [GC], no. 21881/20, §§ 139 and 141, 27 November 2023). A consistent line of adverse rulings by the highest court on a point of law is normally evidence of the absence of such a prospect (see Posevini v. Bulgaria, no. 63638/14, § 54 in fine, 19 January 2017, with further references, and contrast, mutatis mutandis, Dimcho Dimov v. Bulgaria (no. 2), no. 77248/12, § 75, 29 June 2017).

95. As regards compliance with the six-month time-limit, the ongoing retention of the data about the applicant’s penalty amounts to a continuing situation, as noted in paragraph 88 above. The same goes for the ensuing risk of those data being disclosed. That situation allegedly still obtained when the applicant lodged his application with the Court on 10 August 2015, and indeed allegedly persists to this day. This part of the complaint cannot therefore be rejected for failure to comply with the six-month time-limit under Article 35 § 1 of the Convention (see Hilton, cited above, at p. 114).

Alleged loss of victim status

96. The Government submitted that the applicant was no longer a victim, for two reasons. First, a criminal record report about him issued by the Troyan District Court in November 2022 at the Government’s request had contained no entries. Secondly, he had been able to obtain public-sector employment almost immediately after his dismissal from his post as a prison guard had been upheld with final effect (see paragraph 28 above). That dismissal had thus not harmed his career.

97. With regard to the Government’s first point, the applicant queried whether the data about his penalty had indeed been fully deleted, in view of the Government’s assertion elsewhere in their observations that those data were to be kept indefinitely – a position which found some support in the domestic rules on the point. The removal of the data from one place did not mean that they had been fully deleted. As for the Government’s second point, the applicant noted that after his dismissal he had been on unemployment benefits lower than his salary for nine months, and had then remained unemployed and without income for a further fourteen months. The salary for the job which he had started in August 2015 (see paragraph 28 above) had been lower than that which he would have received as a prison guard. Moreover, if he had not been dismissed from that post on grounds of incompatibility, but for other reasons, he would also have received severance pay.

98. The Court is not concerned with whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention in respect of his dismissal from work: he did not complain to it about that dismissal as such. The scope of the case referred to the Court in the exercise of the right of individual application is determined by the applicant’s complaint (see Radomilja and Others, cited above, § 126). It follows that the Court has no jurisdiction to deal with the applicant’s dismissal, and accordingly to examine whether he can still claim to be a victim in respect of that (see, mutatis mutandis, Handzhiyski v. Bulgaria, no. 10783/14, § 31 in fine, 6 April 2021, and Paketova and Others v. Bulgaria, nos. 17808/19 and 36972/19, § 125 in fine, 4 October 2022).

99. Nor is the Court concerned with whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention in respect of the actual disclosure in 2012-13 of the data about his penalty to the authority which was employing him. It has already been established that his complaint in respect of that actual disclosure is inadmissible because it was raised after the expiry of the six-month time-limit under Article 35 § 1 of the Convention (see paragraph 93 above, and compare, mutatis mutandis, Benedik v. Slovenia, no. 62357/14, § 77, 24 April 2018).

100. It follows that the only matter in relation to which it must be ascertained whether the applicant can still claim to be a victim of a violation of Article 8 of the Convention is the ongoing retention and potential disclosure of the data about his substitute administrative penalty.

101. Neither of the two circumstances pleaded by the Government can deprive the applicant of his status as a victim in respect of that matter.

102. Although the record card for the applicant’s penalty was destroyed in 2012 (see paragraph 17 above), it is open to question whether, as claimed by him, the electronic version of the data from that card is still being retained. Although they submitted a copy of a criminal record report issued in November 2022 which did not reflect those data (see paragraph 96 above), the Government did not expressly confirm that the data themselves had been deleted (compare, mutatis mutandis, the circumstances in Uçkan v. Türkiye [Committee], no. 67657/17, § 19, 18 April 2023). Moreover, the applicant’s assertion is confirmed by the Government’s insistence elsewhere in their observations that according to a proper interpretation of the relevant regulations, those data are not subject to deletion (see paragraph 128 below). That position fully matches the position consistently expressed at domestic level by the Ministry of Justice, which drafted those regulations, and by the Supreme Administrative Court – that electronic data about substitute administrative penalties are to be kept indefinitely (see paragraphs 19, 27 and 42-43 above). Indeed, in its oral submissions before the Commission for the Protection of Personal Data in June 2013, after the destruction of the record card, that Ministry confirmed that the data still existed (see paragraph 20 above). It can hence be accepted that those data are still being retained in some form in the Bulgarian criminal records system. It follows that the applicant may claim to be a victim of a violation of Article 8 of the Convention on account of that ongoing retention (see, mutatis mutandis, Catt v. the United Kingdom, no. 43514/15, § 76, 24 January 2019). For as long as those data are retained and remain capable of being disclosed, he remains a victim of any potential breach of that Article flowing from that (see M.M. v. the United Kingdom, cited above, § 159).

103. The effect which the disclosure of those data could have on the applicant’s employment prospects is immaterial in that regard. It is settled that the mere storing by a public authority of data relating to someone’s private life amounts to an interference within the meaning of Article 8 § 2 of the Convention, irrespective of whether or how those data are then used (see Amann v. Switzerland [GC], no. 27798/95, § 69, ECHR 2000-II; S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, §§ 67 and 121, ECHR 2008; Gardel v. France, no. 16428/05, § 58, ECHR 2009; Khelili, cited above, § 55; Aycaguer v. France, no. 8806/12, § 33, 22 June 2017; and Trajkovski and Chipovski v. North Macedonia, nos. 53205/13 and 63320/13, § 51, 13 February 2020).

104. More generally, the existence or absence of prejudice has no bearing on the question of whether someone can claim to be a victim within the meaning of Article 34 (former Article 25) of the Convention; it is relevant only in the context of Article 41 (former Article 50) of the Convention (see, among other authorities, Marckx v. Belgium, 13 June 1979, § 27 in fine, Series A no. 31; Lüdi v. Switzerland, 15 June 1992, § 34, Series A no. 238; and Peev v. Bulgaria, no. 64209/01, § 55, 26 July 2007 ) and also, since June 2010, in assessing whether an applicant has suffered a significant disadvantage within the meaning of Article 35 § 3 (b) of the Convention, which was inserted by Article 12 of Protocol No. 14.

105. It follows that the applicant can still claim to be a victim of a violation of Article 8 of the Convention, and that the Government’s objection in that regard must be dismissed.

No significant disadvantage

106. The Government submitted that despite his subjective perception of how the alleged breach had affected him, the applicant had not suffered a significant disadvantage. They again pointed out that he had later been able to find employment in the public sector, and highlighted his lack of interest in the proceedings relating to the retention of the data about his penalty.

107. The applicant referred to his submissions in relation to his victim status (see paragraph 97 above).

108. The criterion of no significant disadvantage hinges on the idea that a breach of a Convention right, however real from a purely legal point of view, should attain a minimum level of severity to warrant consideration by the Court. The assessment of this minimum is relative and depends on all the circumstances of the case, and the severity of a breach should be gauged taking account of both the applicant’s subjective perceptions and what was objectively at stake. However, even if it is found that the applicant has not suffered a significant disadvantage as a result of the matter complained of, the complaint may nonetheless not be declared inadmissible on this ground if respect for human rights, as defined in the Convention and the Protocols thereto, requires an examination on the merits (see, as a recent authority, X and Others v. Ireland, nos. 23851/20 and 24360/20, § 63, 22 June 2023).

(i) “Significant disadvantage”

109. The Court is not concerned with whether the applicant suffered a significant disadvantage owing to the actual disclosure in 2012-13 of the data about his penalty to the authority which was employing him, an act which resulted in his dismissal. It has already found that his complaint in respect of that actual disclosure is inadmissible because it was raised after the expiry of the six-month time-limit under Article 35 § 1 of the Convention (see paragraph 93 above).

110. It follows that the only matters in relation to which the Court must ascertain whether the applicant has suffered a significant disadvantage are (a) the alleged ongoing retention of data about his penalty and (b) the potential disclosure of those data.

111. There is no evidence that the ongoing retention of those data in itself has caused or is causing the applicant any real detriment. In this type of case, a complaint about retention in reality flows not from the retention itself, but from the fact that if data are retained, the disclosure of those data may follow (see M.M. v. the United Kingdom, cited above, § 159).

112. As regards the potential disclosure of those data, an examination of the relevant domestic regulations makes it plain that the only lawful way in which such data can be disclosed is via a criminal record report (see paragraph 48 above). Such reports can be obtained by only a limited number of authorities, mainly in connection with criminal proceedings, vetting procedures for the purpose of giving people clearance to access classified information, international cooperation in criminal matters, or electoral purposes (see paragraph 46 (b) above).

113. The applicant did not express concern about the data relating to his penalty being used in any criminal proceedings against him. It should also be noted in this connection that under Bulgarian law, people who have been given substitute administrative penalties are not regarded as having been convicted of a criminal offence (see paragraph 29 in fine above). Moreover, they can benefit from such a waiver of criminal liability again if more than a year has passed since the execution of any previous substitute administrative penalty (see paragraph 29 above), as has been the case for the applicant since January 2006, one year after he paid his fine (see paragraph 8 above). Nor has the applicant expressed concern about the possible use of those data for security-clearance or electoral purposes.

114. Instead, the applicant’s concerns in relation to the data about his penalty relate to the effect that their disclosure could have on his employment prospects. It is clear, however, that under the relevant regulations, those data cannot be obtained by a private employer, or indeed by most public-sector employers. Other than for the purposes outlined above, they can be obtained by only “State authorities or bodies authorised by law to obtain such data” (see paragraph 46 (b) above). Apparently, and this was also illustrated by the applicant’s case, in practice, this category consists of State authorities or bodies which need such data to assess (a) whether they can appoint someone to a post which cannot, by law, be occupied by someone who has been given a substitute administrative penalty; or (b) whether they have to dismiss someone already occupying such a post (either because he or she has been appointed owing to an oversight, because his or her penalty has for some reason not come to the attention of the authority employing him or her, or because he or she has been given such a penalty during the course of his or her employment).

115. Until mid-2014 there were many types of public-sector posts in Bulgaria which could not be occupied by people who had received substitute administrative penalties – all of the many thousands of posts in the Ministry of Internal Affairs, and many of the posts in the Chief Directorate for the Execution of Punishments (see paragraphs 30 and 79 above). However, this has not been the case since the Ministry of Internal Affairs Act 2014 came into effect in mid-2014 – contrary to its predecessors, that Act bars only people who have been given a criminal sentence from employment in that Ministry (and thus in the Chief Directorate for the Execution of Punishments) (see paragraphs 30 above). Since mid-2014 a substitute administrative penalty for a wilful offence – as in the applicant’s case – bars people from employment in only a limited number of sensitive or high-ranking posts (see paragraph 31 above). There is no indication that the applicant was realistically envisaging applying for any of those posts.

116. It cannot therefore be said that the applicant was tangibly affected by the potential disclosure of the data about his penalty when he lodged his application with the Court in August 2015 and that he has been similarly affected ever since. Indeed, the fact that he retrospectively withdrew his complaint to the Commission for Personal Data Protection and took no part in the proceedings for judicial review of that Commission’s decision (see paragraphs 22 and 26 above) also suggests that the ongoing retention of those data has not caused him any particular concern in itself.

117. It follows that the alleged retention of the data about the applicant’s penalty and the potential disclosure of those data have not caused him a significant disadvantage within the meaning of Article 35 § 3 (b) of the Convention.

(ii) “Respect for human rights”

118. Respect for human rights nonetheless requires an examination of the merits of a complaint if it raises questions of a general character affecting the observance of the Convention, for instance when there is a need to clarify a State’s obligations or to induce it to resolve a structural deficiency (see, as a recent authority, X and Others v. Ireland, cited above, § 65).

119. The complaint under examination raises broader issues with regard to the compatibility of the retention of data about substitute administrative penalties in Bulgaria with Article 8 of the Convention (compare, mutatis mutandis, E.B. and Others v. Austria, nos. 31913/07 and 4 others, §§ 61 in fine and 63, 7 November 2013). It is telling that those issues, which undoubtedly affect thousands of people in Bulgaria who are given such penalties each year (see paragraph 78 above), have caused a long-running controversy between Bulgaria’s Personal Data Protection Commission and its Ministry of Justice (see paragraphs 19-21, 24 and 42 above). This suggests that they are of a structural character.

120. Moreover, the application of the relevant data protection rules in Bulgaria to criminal record data appears to throw up novel issues with which the Bulgarian authorities are yet to fully grapple, especially since the overhaul of that branch of Bulgarian law following the entry into force of the GDPR and the transposition of the LED (see, mutatis mutandis, Ekimdzhiev and Others v. Bulgaria, no. 70078/12, § 275, 11 January 2022). The substantive issues raised by the complaint hence deserve consideration by the Court (see, mutatis mutandis, M.N. and Others v. San Marino, no. 28005/12, § 39, 7 July 2015; Margari v. Greece, no. 36705/16, § 23, 20 June 2023; and X and Others v. Ireland, cited above, § 65).

121. It follows that respect for human rights as defined in the Convention and the Protocols thereto requires that this complaint be examined on the merits. The Government’s request that it be declared inadmissible with reference to Article 35 § 3 (b) of the Convention must therefore be rejected.

Conclusion on the admissibility of the complaints

122. As noted in paragraph 93 above, in so far as the applicant complained about the actual disclosure in 2012-13 of the data relating to his substitute administrative penalty, his complaint is out of time and must be rejected under Article 35 §§ 1 and 4 of the Convention.

123. Conversely, in so far as the applicant complained about the ongoing retention and potential disclosure of those data, as found in paragraphs 95, 105 and 121 above, his complaint is not inadmissible on any of the grounds cited by the Government. Nor is this part of the complaint manifestly ill-founded or inadmissible on other grounds. It must therefore be declared admissible.

Merits
1. Existence of an interference

124. It is settled that (a) the processing of data about criminal convictions and related measures concerns the private life of the people to whom those data relate, and thus attracts the protection of Article 8 of the Convention, and (b) the processing of such data by the authorities amounts to interference with the data subjects’ right to respect for their private life (see, as a recent authority, N.F. and Others v. Russia, nos. 3537/15 and 8 others, §§ 34 and 38, 12 September 2023). Indeed, the data contained in a criminal record, though often based on a court judgment delivered in public, are sensitive and may affect the individual concerned, and are hence linked to his or her private life (see E.B. and Others v. Austria, cited above, § 75 in fine; see also, mutatis mutandis, Biancardi v. Italy, no. 77419/16, § 67, 25 November 2021, and Hurbain v. Belgium [GC], no. 57292/16, § 215 in fine, 4 July 2023).

125. The parties were in agreement that the retention of data about the applicant’s substitute administrative penalty amounted to interference with his right to respect for his private life under Article 8 of the Convention, and it has already been found in paragraph 102 above that despite the destruction of the record card for that penalty in 2012, the data relating to it are apparently still being retained in some electronic form. As noted in paragraph 103 above, according to the Court’s case-law, the mere storing by a public authority of such data amounts to interference with a person’s right to respect for his or her private life within the meaning of Article 8 § 2 of the Convention, irrespective of whether or how those data are later used.

Whether that interference is justified

126. To be justified under Article 8 § 2 of the Convention, such interference must (a) be “in accordance with the law”; (b) pursue one or more of the legitimate aims set out in that provision; and (c) be “necessary in a democratic society” to attain that aim or those aims.

(a) “In accordance with the law”

127. The applicant submitted that Regulations no. 8 of 2008 contained many points which were unclear. For instance, although regulation 31(1) laid down a time-limit for keeping the record cards for substitute administrative penalties, it said nothing about the retention of the alphabetical index and the incoming register of those cards; the point had not been addressed by any other regulation either. Moreover, the Regulations did not specify what data went into that index and register – data which were to be retained even after the destruction of the cards, according to the Supreme Administrative Court’s interpretation of those Regulations. If the index and register were to be seen as secondary, it made no sense to keep the data in them after the destruction of the cards themselves. Otherwise, the destruction of the cards made no sense from a data protection perspective and was merely the dematerialisation of records. The statutes barring people with substitute administrative penalties from some public-sector posts could not clarify this point either. They could not be interpreted as imposing a lifelong ban on such employment, and hence as requiring the indefinite retention of the data about such penalties. The applicant stated that the uncertainties in the Regulations had been illustrated by the inconsistent manner in which they had been applied by the Troyan District Court in his case (see paragraphs 9-10 and 17 above). The Government’s position on the electronic data about his penalty was also contradictory: they claimed that those data had been destroyed, but also that they were to be kept indefinitely.

128. In the Government’s view, Regulations no. 8 of 2008 were sufficiently clear. The doubt about whether record cards for substitute administrative penalties whose five-year retention period had already expired by the time of the decision in February 2013 to extend it to fifteen years had been promptly resolved by the Supreme Judicial Council’s legal affairs committee. As for the retention of the electronic data taken from such record cards, the Supreme Administrative Court had correctly pointed out that those data were to be kept indefinitely; the position of the Commission for the Protection of Personal Data on the point could not be accepted without qualifications. The main justification for keeping those data indefinitely was to enable the vetting of people employed or seeking employment in specific public-sector posts. The Regulations thus had to be read alongside and in the light of the statutory provisions laying down that prohibition, which was absolute.

(b) “Necessary in a democratic society” for attaining one or more of the aims in Article 8 § 2 of the Convention

(α) General principles

129. To be “in accordance with the law”, an interference must not only have a basis in domestic law; that law must furthermore be accessible and sufficiently foreseeable (see, among many other authorities, N.F. and Others v. Russia, cited above, § 39). With regard specifically to the processing of criminal record data, it is essential to have clear and detailed rules governing the scope and application of such measures, and minimum safeguards concerning, among other things, duration, storage, usage, access of third parties, and the procedures for preserving the integrity and confidentiality of the data and their destruction (see M.M. v. the United Kingdom, § 195, and N.F. and Others v. Russia, § 40, both cited above). At each stage of the processing of such data, appropriate safeguards which reflect the principles set out in the applicable data protection instruments must be in place (see M.M. v. the United Kingdom, cited above, § 195 in fine).

(β) Application of those principles

130. The salient question in this case is whether the regulations governing the ongoing retention of the data about the applicant’s substitute administrative penalty are sufficiently foreseeable.

131. Those regulations lay down clear a time-limit (five years up until February 2013, and fifteen years since then) for keeping record cards for substitute administrative penalties (see paragraph 38 above). By contrast, the regulations appear to contain ambiguity on the question of whether the electronic data derived from those cards are to be deleted alongside the record cards themselves, or whether they are to be retained for longer or indeed indefinitely (see paragraphs 38-39 above). With the digitalisation of the relevant records (see paragraph 35 above), this question takes on considerable importance.

132. The Bulgarian Ministry of Justice, which drafted those regulations (see paragraph 32 above), considered that the correct interpretation of the regulations was that they required the indefinite retention of those electronic data (see paragraphs 19, 20, 24 and 42 above). By contrast, the Bulgarian data protection authority, the Commission for the Protection of Personal Data, was firmly of the opposite view – that the regulations, properly construed, required that electronic data derived from the record cards be deleted along with the cards themselves, and that any indefinite retention of personal data was inconsistent with the strictures of Bulgarian data protection law (see paragraphs 21 and 42 above). Since that Commission is a body with special competence and expertise in this domain, its views on the point cannot be discounted lightly (contrast, mutatis mutandis, Ivan Todorov v. Bulgaria, no. 71545/11, § 38, 19 January 2017).

133. Regulations which are vague enough to cause confusion even among the national authorities in charge of their interpretation and application can hardly be seen as sufficiently foreseeable (see, mutatis mutandis, Jėčius v. Lithuania, no. 34578/97, § 59, ECHR 2000-IX; Nasrulloyev v. Russia, no. 656/06, §§ 76-77, 11 October 2007; and Svetoslav Dimitrov v. Bulgaria, no. 55861/00, §§ 58-60, 7 February 2008).

134. It is also of some significance that there is an apparent contradiction between the position expressed on that point by the Ministry of Justice and the manner in which in 2021 it framed the new regulation governing the deletion of data relating to substitute administrative penalties imposed on third-country nationals in the EU criminal records database ECRIS-TCN (see paragraphs 44-45 above). In accordance with that regulation, all electronic data about such penalties are to be deleted after the retention period for the record card for the respective substitute administrative penalty has expired. It cannot be excluded that this difference in approach as to the time-limit for keeping the data is justified by the different purposes for which information in the domestic criminal records system (see paragraphs 46-48 above) and information in the ECRIS-TCN is disclosed. However, this is not apparent from the relevant regulations, and it does not seem that the difference has been explained.

135. It is true that the Bulgarian Supreme Administrative Court, which has the power to review the decisions of the Commission for the Protection of Personal Data, endorsed the interpretation favoured by the Ministry of Justice – that according to a proper construction of the relevant regulations, the electronic version of the data about substitute administrative penalties was to be retained indefinitely (see paragraphs 27 and 43 above). However, when doing so, that court did not attempt to explain how such indefinite retention could tally with, in particular, the principle of storage limitation in data protection law. The court confined itself to a reference to section 2(2)(1) and (2)(2) of the 2002 Act, which set out the data protection principles of lawful and fair processing and purpose limitation (see paragraph 56 (a) and (b) above), but said nothing about section 2(2)(6) of the same Act, which at the time set out the principle of storage limitation (see paragraph 56 (c) above). Indeed, that principle has been part and parcel of Bulgaria’s domestic data protection law since before the amendment of section 2(2) of the 2002 Act in 2005, when the Act was brought into line with Directive 95/46/EC (see paragraph 57 above). The principle featured already in point (e) of Article 5 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (see paragraph 77 above), which has been part of Bulgarian domestic law since 2003 and takes precedence over any conflicting provisions of domestic legislation (see paragraph 50 above). The principle was then fully reaffirmed in Article 5 § 1 (e) of the GDPR, which has been directly applicable in Bulgaria since May 2018 (see paragraphs 60 and 68 (c) above, and, mutatis mutandis, Spasov v. Romania, no. 27122/14, §§ 92-93, 6 December 2022), as well as in the 2019 amendments to the 2002 Act transposing the LED (see paragraphs 56 (c), 57, 73 (c) and 74 above). It is not in doubt that this principle applies to the data retention in issue in the present case. The CJEU has recently confirmed that (a) all data protection principles apply to the processing of personal data relating to criminal convictions and offences, including road traffic offences (see paragraphs 69 and 72 above), and (b) those principles apply cumulatively, which means that any processing of personal data must comply with all and not just some of them (see paragraph 69 in fine above).

136. Another apparent inconsistency flows from the remark of the Supreme Administrative Court that the indefinite retention of data about substitute administrative penalties was necessary for a core law-enforcement purpose: to ensure effective implementation of the statutory bar on an offender being able to benefit from such a waiver of criminal liability more than once (see paragraphs 27 and 43 in fine above). Even if true, such a purpose does not seem to justify the indefinite retention of data. In addition, that remark is hard to square with the firm position of Bulgaria’s former Supreme Court and its Supreme Court of Cassation that according to a proper construction of the relevant provisions of Bulgaria’s Criminal Code, it is possible to benefit from a waiver of criminal liability again if more than one year has passed since the execution of any previous substitute administrative penalty or since the expiry of the limitation period for its enforcement (see paragraph 29 above).

137. In the light of these discrepancies, which are not for the Court to resolve, including as regards the application of EU law (see, mutatis mutandis, Parti nationaliste basque – Organisation régionale d’Iparralde v. France, no. 71251/01, § 48, ECHR 2007-II; Avotiņš v. Latvia [GC], no. 17502/07, § 100, 23 May 2016; Krombach v. France (dec.), no. 67521/14, § 39, 20 February 2018; Stoyan Nikolov v. Bulgaria, no. 68504/11, § 58, 20 July 2021; and Moraru v. Romania, no. 64480/19, § 54, 8 November 2022), it cannot be accepted that the ongoing retention of the data about the applicant’s substitute administrative penalty is “in accordance with the law” within the meaning of Article 8 § 2 of the Convention.

138. The applicant submitted that the way in which the relevant domestic rules were framed left it uncertain what legitimate aim was being pursued by the indefinite retention of data about substitute administrative penalties. The aim cited by the Supreme Administrative Court – to ensure that no one could benefit from such a waiver of criminal liability more than once – clearly did not exist, since the Supreme Court of Cassation had clarified long ago that this was possible. In any event, such indefinite retention was disproportionate, especially since it concerned not only people seeking to apply for certain public-sector posts, but anyone who had received such a penalty.

139. The Government submitted that the indefinite retention of data about substitute administrative penalties was “necessary in a democratic society” for the narrow purpose of ensuring that only people with completely clean criminal records could be employed in certain security and law-enforcement services. This corresponded to several of the legitimate aims set out in Article 8 § 2 of the Convention. It was also of great importance, as the people employed in those services had to meet high moral and professional standards. There were no less intrusive means of ensuring that, and the resulting interference was quite limited, affecting only people willing to pursue such careers.