CEDH · CASELAW;JUDGMENTS;CHAMBER;ENG — 16 avril 2024

.s800EAC49 { font-size:12pt } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sBB9EE52A { font-family:Arial } .s523616E0 { margin-top:0pt; margin-bottom:12pt; text-align:center; font-size:14pt } .s5297CEC5 { margin-top:48pt; margin-bottom:14pt; text-align:center } .s29100277 { font-family:Arial; font-weight:bold } .sA36B60A1 { font-family:Arial; font-style:italic } .s39E5096F { margin-top:0pt; margin-bottom:14pt; text-align:center } .s69117BAC { margin-top:0pt; margin-bottom:26pt; text-align:center } .s780F5245 { border:0.75pt solid #000000; clear:both } .sE77B86B8 { margin-top:0pt; margin-bottom:0pt; text-align:justify; padding-top:1pt; padding-right:4pt; padding-left:4pt } .s440A90EC { margin-top:0pt; margin-bottom:0pt; text-align:center; padding-right:4pt; padding-left:4pt; font-size:10pt } .sF9E8C072 { margin-top:0pt; margin-bottom:0pt; text-align:center; padding-right:4pt; padding-left:4pt; padding-bottom:1pt; font-size:10pt } .s8229ABDD { margin-top:0pt; margin-bottom:12pt; text-align:center } .s598389FB { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:14pt } .sF5E1C6CF { font-family:Arial; font-weight:bold; text-decoration:underline; color:#ff0000 } .sE208486F { font-family:Arial; color:#ff0000 } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s85016119 { margin-top:0pt; margin-bottom:0pt; text-align:justify; font-size:11pt } .s82B4DA5F { page-break-before:right; clear:both; mso-break-type:section-break } .s953FCA47 { margin-top:8pt; margin-left:17pt; margin-bottom:3pt; text-indent:-17pt; page-break-after:avoid; line-height:12pt } .s7ED160F0 { text-decoration:none } .s659CE682 { font-family:Arial; font-size:11pt; font-weight:bold; text-decoration:underline; color:#0069d6 } .s3013787D { margin-top:0pt; margin-left:34pt; margin-bottom:3pt; text-indent:-17pt; page-break-after:avoid; line-height:12pt } .s92A5AB2 { font-family:Arial; font-size:11pt; text-decoration:underline; color:#0069d6 } .s695099B3 { width:10.89pt; text-indent:0pt; display:inline-block } .sEAB539EC { width:7.83pt; text-indent:0pt; display:inline-block } .s554D0A64 { width:4.78pt; text-indent:0pt; display:inline-block } .sC15FC45D { width:3.55pt; text-indent:0pt; display:inline-block } .sB85C84E0 { margin-top:0pt; margin-left:51pt; margin-bottom:3pt; text-indent:-17pt; page-break-after:avoid; line-height:12pt } .sB6D33163 { font-family:Arial; font-size:10pt; text-decoration:underline; color:#0069d6 } .s833B1EA7 { width:7.55pt; text-indent:0pt; display:inline-block } .s19606355 { margin-top:0pt; margin-left:68.05pt; margin-bottom:3pt; text-indent:-17pt; page-break-after:avoid; line-height:12pt } .sD46FFE5D { width:8.66pt; text-indent:0pt; display:inline-block } .sDF290AB { width:6.61pt; text-indent:0pt; display:inline-block } .s4859184F { width:7pt; text-indent:0pt; display:inline-block } .sD5295FC2 { margin-top:0pt; margin-left:85.05pt; margin-bottom:3pt; text-indent:-17pt; line-height:12pt } .s72A8FB50 { width:5.34pt; text-indent:0pt; display:inline-block } .s57F719EC { margin-top:0pt; margin-left:102.05pt; margin-bottom:3pt; text-indent:-17pt; line-height:12pt } .s8E0B8B88 { width:8.12pt; text-indent:0pt; display:inline-block } .sF53451E7 { width:5.9pt; text-indent:0pt; display:inline-block } .s4DA599D8 { margin-top:0pt; margin-left:119.05pt; margin-bottom:3pt; text-indent:-17pt; line-height:12pt } .s31A6B95 { width:4.56pt; text-indent:0pt; display:inline-block } .sC9B5F0A5 { width:4.59pt; text-indent:0pt; display:inline-block } .s25F5CC02 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; font-size:10pt } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sB9D5CABB { width:28.35pt; display:inline-block } .s3AAE10DF { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .s6B505E72 { margin:0pt; padding-left:0pt } .s28F0D84C { margin-top:14pt; margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.78pt; font-family:Arial; text-transform:uppercase } .s8B983D37 { text-transform:none } .sDA7B489D { margin-top:14pt; margin-left:15pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:3.45pt; font-family:Arial; text-transform:uppercase } .s5C5C410E { margin-top:14pt; margin-left:18.34pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.11pt; font-family:Arial; text-transform:uppercase } .s21DA5120 { margin-top:14pt; margin-left:18.45pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial } .s743F3A55 { margin-right:0pt; margin-left:0pt; padding-left:0pt } .sC725E288 { margin-left:7.05pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-weight:bold } .s5E8F5A28 { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-weight:bold } .s2044A09A { margin-left:6.51pt; margin-bottom:6pt; page-break-inside:avoid; page-break-after:avoid; padding-left:1.99pt; font-weight:normal; font-style:italic } .sAE6FB95D { margin-top:14pt; margin-left:32.01pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.99pt; font-family:Arial; font-style:italic } .sEF02C8EA { margin-top:14pt; margin-left:16.34pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:2.11pt; font-family:Arial } .sDECD9755 { margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.78pt; font-family:Arial; text-transform:uppercase } .s879C130D { margin-left:7.05pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; font-weight:bold; text-transform:none } .s33165EBA { font-family:Arial; font-size:8pt; vertical-align:super; color:#0069d6 } .s4BAE41EE { font-family:Arial; font-size:11pt } .s2A91C753 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; page-break-after:avoid } .s6E3ECC44 { margin-top:14pt; margin-left:32.01pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; padding-left:1.99pt; font-family:Arial; font-style:italic } .sF54F3725 { margin-top:0pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sDBC81028 { width:4.83pt; font:7pt 'Times New Roman'; display:inline-block } .s65DDED6B { margin-top:14pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s7AE800C3 { width:4.28pt; font:7pt 'Times New Roman'; display:inline-block } .sDD998142 { margin-top:14pt; margin-left:17pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .sB706BD6C { margin-left:11.67pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.18pt; font-family:Arial; text-transform:uppercase } .s434D37A9 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sD0489F03 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sED360BAA { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; page-break-inside:avoid; font-size:10pt } .s599F5480 { margin-top:0pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s3970C00F { width:8.17pt; font:7pt 'Times New Roman'; display:inline-block } .s4B52A9A9 { margin-top:14pt; margin-left:51.05pt; margin-bottom:6pt; text-indent:-17.05pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s320E5A8E { width:5.95pt; font:7pt 'Times New Roman'; display:inline-block } .s5C494981 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid } .s695E2BCF { margin-top:0pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-19.8pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s16F6432D { width:7.9pt; font:7pt 'Times New Roman'; display:inline-block } .sFABD3260 { margin-top:14pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-19.8pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sFF8BF293 { width:8.05pt; font:7pt 'Times New Roman'; display:inline-block } .sCD7D0356 { margin-top:14pt; margin-left:15pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:4.85pt; font-family:Arial; text-transform:uppercase } .sAD1DAC71 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; page-break-inside:avoid; padding-left:1.99pt; font-family:Arial } .sFBC99493 { font-style:italic } .sD58C010 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:1.99pt; font-family:Arial } .sADD4F530 { margin-top:0pt; margin-left:34pt; margin-bottom:0pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid } .sE5BF05B1 { width:2.33pt; font:7pt 'Times New Roman'; display:inline-block } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s69DCC830 { margin-top:36pt; margin-bottom:0pt } .sC2E086EB { width:36.89pt; display:inline-block } .s871A718A { width:136.42pt; display:inline-block } .s5A65B3DC { width:46.56pt; display:inline-block } .s44B8752F { width:177.11pt; display:inline-block } .s379BC09C { margin-top:36pt; margin-bottom:0pt; text-align:right } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .sF6A12959 { width:33%; height:1px; text-align:left } .s77C3FB1E { margin-top:0pt; margin-bottom:0pt; text-align:justify; page-break-inside:avoid; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 }   THIRD SECTION CASE OF BORISLAV TONCHEV v. BULGARIA (Application no. 40519/15)     JUDGMENT Art 8 • Private life • Ongoing retention of data about the applicant’s substitute administrative penalty (a type of non-conviction disposal of a criminal case) • Relevant regulations vague enough to cause confusion among national authorities in charge of their interpretation and application and thus not sufficiently foreseeable • Discrepancies included the application of EU data protection law (principle of storage limitation) • Interference not “in accordance with the law”   Prepared by the Registry. Does not bind the Court.   STRASBOURG 16 April 2024   FINAL   16/07/2024   This judgment has become final under Article 44 § 2 of the Convention. It may be subject to editorial revision.   TABLE OF CONTENTS INTRODUCTION THE FACTS I.   THE APPLICANT’S APPOINTMENT AS A PRISON GUARD II.   THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY III.   THE APPLICANT’S DISMISSAL AND HIS LEGAL CHALLENGE AGAINST IT IV.   PROCEEDINGS RELATING TO THE DATA ABOUT THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY A.   Request for the deletion of the record card for the penalty B.   Complaint to the Commission for the Protection of Personal Data 1.   Proceedings before the Commission 2.   Proceedings for judicial review of the Commission’s decision V.   THE APPLICANT’S SUBSEQUENT EMPLOYMENT RELEVANT LEGAL FRAMEWORK I.   SUBSTITUTE ADMINISTRATIVE PENALTIES II.   RETENTION AND DISCLOSURE OF CRIMINAL RECORDS A.   Regulations governing those matters B.   Authority tasked with retaining and disclosing criminal records C.   Periods for the retention of criminal records 1.   Conviction record cards 2.   Record cards for substitute administrative penalties 3.   Data records about the criminal history of third-country nationals D.   Manner of disclosing criminal records III.   RELEVANT DATA PROTECTION PROVISIONS A.   Provisions as they stood between the time when Bulgaria acceded to the EU (1   January 2007) and the entry into force of the General Data Protection Regulation in May 2018 and the transposition of Directive (EU) 2016/680 into   Bulgarian law in March 2019 1.   Scope of application 2.   Principles relating to the processing of personal data 3.   Remedies in respect of allegedly unlawful data processing B.   Provisions as they have been since the entry into force of the General Data Protection Regulation in May 2018 and the transposition of Directive   (EU)   2016/680 into Bulgarian law in March 2019 1.   Scope of application 2.   Principles relating to the processing of personal data (a)   Processing falling within the scope of the GDPR (b)   Processing of criminal record data falling within the scope of the   GDPR (c)   Processing falling within the scope of the LED 3.   Remedies in respect of allegedly unlawful data processing RELEVANT COUNCIL OF EUROPE MATERIAL RELEVANT STATISTICAL DATA THE LAW I.   ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION A.   Scope of the complaint B.   Admissibility 1.   Exhaustion of domestic remedies and compliance with the six-month time-limit` (a)   The parties’ submissions (i)   Exhaustion of domestic remedies (ii)   Compliance with the six-month time-limit (b)   The Court’s assessment (i)   The actual disclosure (ii)   Alleged ongoing retention and ensuing risk of disclosure 2.   Alleged loss of victim status (a)   The parties’ submissions (b)   The Court’s assessment 3.   No significant disadvantage (a)   The parties’ submissions (b)   The Court’s assessment (i)   “Significant disadvantage” (ii)   “Respect for human rights” 4.   Conclusion on the admissibility of the complaints C.   Merits 1.   Existence of an interference 2.   Whether that interference is justified (a)   “In accordance with the law” (i)   The parties’ submissions (ii)   The Court’s assessment (α)   General principles (β)   Application of those principles (b)   “Necessary in a democratic society” for attaining one or more of the aims in Article 8 § 2 of the Convention (i)   The parties’ submissions (ii)   The Court’s assessment (c)   Conclusion II.   APPLICATION OF ARTICLE 41 OF THE CONVENTION A.   Pecuniary damage 1.   The applicant’s claim and the Government’s comments on it 2.   The Court’s assessment B.   Non-pecuniary damage 1.   The applicant’s claim and the Government’s comments on it 2.   The Court’s assessment C.   Costs and expenses 1.   The applicant’s claim and the Government’s comments on it 2.   The Court’s assessment (a)   Lawyer’s fees (b)   Translation costs (c)   Payment of the award for costs CONCURRING OPINION OF JUDGE PAVLI In the case of Borislav Tonchev v. Bulgaria, The European Court of Human Rights (Third Section), sitting as a Chamber composed of:   Pere Pastor Vilanova, President ,   Jolien Schukking,   Yonko Grozev,   Darian Pavli,   Peeter Roosma,   Ioannis Ktistakis,   Oddný Mjöll Arnardóttir, judges , and Milan Blaško, Section Registrar , Having regard to: the application (no. 40519/15) against the Republic of Bulgaria lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Bulgarian national, Mr Borislav Kirilov Tonchev (“the applicant”), on 10   August 2015; the decision to give the Bulgarian Government (“the Government”) notice of the complaint under Article 8 of the Convention about the retention and the actual and potential disclosure of the applicant’s criminal record, and to declare inadmissible the remainder of the application; and the parties’ observations; Having deliberated in private on 19 March 2024, Delivers the following judgment, which was adopted on that date: INTRODUCTION 1.     The key issue in this case is whether the allegedly indefinite retention of data about a substitute administrative penalty (a type of non-conviction disposal of a criminal case) imposed on the applicant in 2004 is “in accordance with the law” within the meaning of Article 8 § 2 of the Convention, particularly in the light of the diverging views of various national authorities on whether the relevant domestic regulations require such indefinite retention and whether it is consistent with data protection law. THE FACTS 2.     The applicant was born in 1981 and lives in Lovech. He was represented by Mr A. Kashamov, a lawyer practising in Sofia. 3.     The Government were represented by their Agent, Ms M. Ilcheva of the Ministry of Justice. THE APPLICANT’S APPOINTMENT AS A PRISON GUARD 4.     In March 2004 the applicant applied for the post of prison guard. In support of his application, he submitted a conviction certificate (see paragraphs 46 (a) and 47 below) issued on 12 March 2004, and certificates issued again in March 2004 by the local district prosecutor’s office and investigation service attesting that he had no convictions or sentences or substitute administrative penalties. 5.     In June 2004 the applicant was appointed as a prison guard, with effect from 1 July 2004. THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY 6 .     In the meantime, in May 2004 the applicant had been caught driving his car while drunk. In September 2004 the Pleven District Court found him guilty of driving a motor vehicle while having a blood alcohol content of more than 1.2 per mille, contrary to Article 343b § 1 of the Criminal Code (a formal wilful offence). The court waived his criminal liability, but found that he was administratively liable and gave him a substitute administrative penalty – a fine of 500 Bulgarian levs (BGN) – in accordance with Article 78a of the same Code (see paragraph 29 below). That judgment became final on 20   October 2004. 7 .     As required under the relevant regulations (see paragraphs 33-35 below), on 26 October 2004 a record card ( бюлетин ) for that penalty was drawn up and stored in the Troyan District Court’s criminal records bureau. 8 .     On 11 January 2005 the applicant paid the fine. THE APPLICANT’S DISMISSAL AND HIS LEGAL CHALLENGE AGAINST IT 9 .     In July 2012 the Ministry of Justice opened a competition for posts in the directorate responsible for ensuring the security of the judiciary. In August 2012 the applicant applied for one of those posts. Following that application, on 14 August 2012 that directorate sought and obtained from the Lovech District Court’s criminal records bureau a criminal record report (see paragraphs 46 (b) and 48 below) which mentioned the applicant’s substitute administrative penalty (see paragraph 6 above). To issue the report, the bureau obtained data about that penalty electronically, from the Troyan District Court’s criminal records bureau, which was keeping the record card for the penalty (see paragraph 7 above). On 23 August 2012 that directorate again sought and obtained from the Lovech bureau a criminal record report which also mentioned the penalty, but added that in the meantime, on 20   August 2012 the record card for the penalty had been destroyed (see paragraphs 16-17 below). On the basis of the data about his penalty, in October 2012 the applicant was not allowed to participate in the appointment competition. 10 .     The criminal record report issued on 14 August 2012 was also sent to the authority employing the applicant, the Chief Directorate for the Execution of Punishments. In the light of the data about his penalty, in November 2012 the Chief Directorate also sought from the Troyan District Court’s criminal records bureau a criminal record report about the applicant. The report, which became available on 28 November 2012, stated that the applicant had no convictions and did not mention his substitute administrative penalty. The Chief Directorate invited the Troyan bureau to explain the discrepancy between that report and the earlier report by the Lovech bureau (see paragraph   9 above). In a letter of 10 January 2013 the Troyan District Court explained that the discrepancy was due to the record card for the applicant’s penalty being destroyed on 19 November 2012 (see paragraphs 16-17 below). 11 .     In March 2013 the Chief Directorate dismissed the applicant from his post as a prison guard, on the basis that the criminal record report issued by the Lovech District Court’s criminal records bureau and the information from the Troyan District Court showed that he had received a substitute administrative penalty, and that his remaining in that post was incompatible with such a penalty, in accordance with statute law (see paragraph 30 in fine below). 12 .     The applicant sought judicial review of his dismissal. He argued, inter alia , that the Chief Directorate had obtained the data about his penalty unlawfully. The only way in which an employer could access criminal record data was by way of a conviction certificate; criminal record reports could only be used for law-enforcement purposes. 13 .     In February 2014 the Sofia City Administrative Court dismissed the claim. It held, inter alia , that the fact that the data about the applicant’s penalty had been obtained by way of a criminal record report issued by the Lovech District Court’s criminal records bureau could not affect the lawfulness of his dismissal (see реш. № 1053 от 24.02.2014 г. по адм. д. №   9360/2013 г., АдмС-София-град ). 14 .     The applicant appealed on points of law. He argued, inter alia , that the only proper way of ascertaining the existence of his penalty had been via data taken from the record card for the penalty, and that after the lawful destruction of that card owing to the expiry of the relevant time-limit (see paragraphs 17 and 38 below) it had been impermissible for those data to be obtained by other means. 15 .     On 11 February 2015 the Supreme Administrative Court upheld the lower court’s judgment. It held that by law, prison officers with substitute administrative penalties had to be dismissed (see paragraph 30 in fine below). It went on to say that the law did not require that the data about those penalties be obtained by the employer in any particular way. The applicant’s arguments in that regard were hence irrelevant. It was sufficient that there existed a criminal record report showing that he had been given such a penalty ( реш.   №   1532 от 11.02.2015 г. по адм. д. № 5112/2014 г., ВАС, V о. ). PROCEEDINGS RELATING TO THE DATA ABOUT THE APPLICANT’S SUBSTITUTE ADMINISTRATIVE PENALTY Request for the deletion of the record card for the penalty 16 .     Apparently in reaction to the criminal record report issued on 14   August 2012 by the Lovech District Court’s criminal records bureau on the basis of the data obtained electronically from the Troyan District Court’s criminal records bureau (see paragraph 9 above), on 16 August 2012 the applicant asked the latter to destroy the record card for his substitute administrative penalty, noting that more than five years had elapsed since the judgment imposing that penalty had become final (see paragraph 38 below). 17 .     On 17 August 2012, the following day, the President of the Troyan District Court tasked a committee consisting of a judge and three court officials with destroying all record cards for substitute administrative penalties imposed by judgments which had become final more than five years previously. Basing itself on, inter alia , the regulation governing the time-limit for destroying such record cards (see paragraph 38 below), on 20 August 2012 that committee earmarked the card for the applicant’s penalty for destruction. Three months later, on 19 November 2012, the same committee earmarked all such cards whose five-year retention period had expired for destruction. On 5 December 2012 the State Archives Agency approved their destruction, and they were apparently destroyed shortly after that. Complaint to the Commission for the Protection of Personal Data Proceedings before the Commission 18 .     In the meantime, in November 2012 the applicant had complained to the Commission for the Protection of Personal Data (see paragraph 58 below) that the Ministry of Justice had processed his personal data unlawfully, since the Troyan District Court’s criminal records bureau had kept the record card for his penalty after October 2009, despite the expiry of the five-year period for its retention under the relevant regulation (see paragraph 38 below), and those data had then been used to prevent him from participating in the competition organised by the Ministry (see paragraph 9 above). The applicant urged the Commission to give directions for the breach of the relevant data protection requirements to cease and impose sanctions in relation to it. The Commission, on its own initiative, joined the Troyan District Court to the proceedings as a second respondent. 19 .     In its written submissions in response to the applicant’s complaint, the Ministry of Justice maintained, inter alia , that in accordance with a proper interpretation of the applicable regulations, the retention time-limit in one such regulation (see paragraph 38 below) concerned only the record cards themselves, not the data featuring in them. 20 .     The Commission heard the complaint on 4 June 2013. The applicant did not appear and was not represented. The Ministry of Justice was represented by in-house legal counsel and one of its data-processing officers. In response to a question by the Commission as to how the Ministry had been able to ascertain that the applicant had been given a substitute administrative penalty after the expiry of the five-year time-limit for keeping the record card for that penalty, the Ministry’s data-processing officer replied that the data did in fact still exist, and its counsel stated that the time-limit concerned only the cards themselves, not the data on them, which remained in the relevant database and were not subject to deletion after five years; they were to be retained indefinitely. 21 .     In June 2013 the Commission unanimously upheld the applicant’s complaint. It found that the retention of the data about his penalty by the Troyan District Court’s criminal records bureau after the expiry of the five-year period for keeping the record card for that penalty in October 2009 (see paragraph 38 below) had been in breach of section 2(2)(2) of the Protection of Personal Data Act 2002 (see paragraph 56 (b) below), which required that personal data be collected for specified, clearly defined and lawful purposes, and not processed additionally in a manner incompatible with those purposes. The retention of the data in issue after the expiry of the relevant time-limit had been devoid of any legal basis. The disclosure of such data to the Lovech District Court’s criminal records bureau in August 2012 (see paragraph 9 above) had thus also been unlawful. The Commission fined the Troyan District Court for those two breaches of the Act (see реш. № Ж-335/2012 от   26.06.2013 г., КЗЛД ). Proceedings for judicial review of the Commission’s decision 22 .     The Troyan District Court sought judicial review of the Commission’s decision. 23 .     Following the lodging of that judicial review claim, in July 2013 the applicant declared that he wished to withdraw his complaint to the Commission. He stated that he disagreed with the Commission’s findings against the Troyan District Court and had not directed his complaint against that court. The applicant did not appear and was not represented at the hearing before the Sofia City Administrative Court. 24 .     In its written submissions in support of the Troyan District Court’s claim, the Ministry of Justice reiterated that the time-limit for keeping the record cards for substitute administrative penalties only concerned the cards themselves, not the data on them, which were to be retained indefinitely. That was in line with a systematic reading of the relevant regulations – in particular those governing the alphabetical indexes and electronic archives kept by the competent criminal records bureaux – and the whole logic of the criminal records system as it had been set up. 25 .     In November 2013 the Sofia City Administrative Court found the Commission’s decision null and void on the basis that the Commission’s competence to give a decision in respect of the applicant’s complaint had disappeared with retrospective effect when he had withdrawn the complaint after the delivery of that decision (see реш. № 7373 от 26.11.2013 г. по адм.   д. № 7597/2013 г., АдмС-София-град ). 26 .     The Commission appealed on points of law. The applicant chose not to take part in the appeal proceedings either. 27 .     On 27 November 2014 the Supreme Administrative Court upheld the lower court’s judgment. It held that the Commission had erred by fining the Troyan District Court, since the applicant’s complaint had been directed solely against the Ministry of Justice. The Commission had also been wrong to find that the Troyan District Court had been processing the applicant’s data unlawfully. That court had been doing so for lawful purposes, in line with the relevant regulations (see paragraph 32 below), and had not retained the data in breach of a relevant time-limit. It was true that under the applicable regulation, a record card for a substitute administrative penalty was to be destroyed five years after the judgment imposing that penalty had become final (see paragraph 38 below). There was, however, no provision for the data from that card to be deleted as well; in accordance with another regulation (see paragraph 39 below), those data were to be retained in the alphabetical index and electronic archive kept by the competent criminal records bureau (see paragraphs 35-36 below). That was fully in line with Article 78a § 1 (b) of the Criminal Code, in accordance with which no one could benefit from a waiver of criminal liability more than once (see paragraph 29 below). The Troyan District Court had thus not acted in breach of section 2(2)(1) or (2)(1) of the Protection of Personal Data Act 2002 (see paragraph 56 (a) and (b) below). All those factors constituted grounds to quash the Commission’s decision, not to declare it null and void, but since the effects of those two ways of disposing of the case were identical, there was no reason to interfere with the lower court’s judgment (see реш. № 14179 от 27.11.2014 г. по адм.   д. № 2069/2014 г., ВАС, V о. ). THE APPLICANT’S SUBSEQUENT EMPLOYMENT 28 .     In August 2015 the applicant started working for the National Revenue Service. He remained employed there, in various posts, until February 2023, when he took up a permanent post as a judicial assistant at the Lovech Regional Court, where he works to this day apparently. RELEVANT LEGAL FRAMEWORK SUBSTITUTE ADMINISTRATIVE PENALTIES 29 .     In some circumstances, Article 78a §§ 1 and 4 of the Criminal Code requires the courts to waive a convicted person’s criminal liability and replace it with administrative liability and therefore an administrative penalty (for details, see   Genov and Sarbinska v. Bulgaria , no. 52358/15, § 41, 30   November 2021). In accordance with Article 78a § 1 (b), this can happen only once, but the former Supreme Court and the Supreme Court of Cassation have held that this may happen again if more than one year has passed since the execution of the previous substitute administrative penalty or since the expiry of the limitation period for its enforcement (see пост. № 7 от   04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4 , and тълк. реш. № 2 от 28.02.2018 г. по тълк. д. № 2/2017 г., ВКС, ОСНК, т. 7 и т. 8 ). The former Supreme Court has clarified that people who have been given such a substitute administrative penalty are not considered to have been criminally convicted, and that the provisions concerning rehabilitation do not concern them (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4 ). 30 .     Until mid-2014, people given such a penalty could not be employed as civil servants in the Ministry of Internal Affairs (section 179(1)(2) of the Ministry of Internal Affairs Act 2006, repealed in 2014, and its predecessor, section 193(1)(2) of the Ministry of Internal Affairs Act 1997). Accordingly, ascertaining the existence of such a penalty was grounds to dismiss a civil servant in that Ministry (section 245(1)(7)(e) of the 2006 Act). Under section   19(2) of the Execution of Punishments and Pre-Trial Detention Act 2009, employees of the Chief Directorate for the Execution of Punishments who are directly responsible for enforcement duties – such as prison guards   – must, unless otherwise provided in the Act, meet the appointment requirements of the Ministry of Internal Affairs Act. Until mid-2014, people given such a penalty could therefore not serve in such posts either. 31 .     People given such a penalty in respect of a wilful offence cannot be (a)     officers in the State Agency for National Security (section 53(1)(4) of the State Agency for National Security Act 2007); (b)     officers in the National Security Service (section 39(3)(1) of the National Security Service Act 2015); (c)     forest guards (section 198(2)(2) of the Forests Act 2011), ski patrolmen (regulation 25(2)(2) of the 2015 Regulations for the safety of ski slopes); (d)     head or deputy head of the State Intelligence Agency (section 15(1)(4) of the State Intelligence Agency Act 2015); (e)     head or deputy head of the Military Intelligence Service (section   26(1)(4) of the Military Intelligence Act 2015); (f)     head or deputy head of the Technical Operations Agency attached to the Council of Ministers (section 19c(4)(4) of the Special Surveillance Means Act 1997); (g)     head of the National Protection Service (section 8(2)(4) of the National Protection Service Act 2015); (h)     members of the Commission for the Forfeiture of Proceeds of Crime (section 10(1)(1) of the Forfeiture of Proceeds of Crime Act 2018); (i)     members of the Commission for the Prevention of Corruption (section 10(1)(1) of the Prevention of Corruption Act 2023); (j)     members of the Central Electoral Commission or a regional or municipal electoral commission (Article 50 § 3 (1), Article 65 § 3 and Article   80 § 3 of the 2014 Electoral Code); or (k)     elected members of the Supreme Judicial Council (section 18(1)(8) of the Judiciary Act 2007). RETENTION AND DISCLOSURE OF CRIMINAL RECORDS Regulations governing those matters 32 .     Since March 2008 the retention and disclosure of data about convictions and substitute administrative penalties (see paragraph 29 above) have been governed by Regulations no. 8 of 2008 of the Minister of Justice ( Наредба № 8 от 26.02.2008 г. за функциите и организацията на дейността на бюрата за съдимост ). Those Regulations were amended in various respects in February 2013, July 2014, October 2015, February 2018, July and December 2020, December 2021, and August 2022. Before March 2008 those matters were governed by Regulations no. 1 of 2000 of the Minister of Justice (and before that, by Regulations no. 466 of 1975 and then by Regulations no. 1 of 1986 of the Minister of Justice). Authority tasked with retaining and disclosing criminal records 33 .     Under Regulations no. 8 of 2008, there is a criminal records bureau attached to each district court, plus a central criminal records bureau attached to the Ministry of Justice (regulations 1-3; see also section 77(3) and (4) of the Judiciary Act 2007). Each district bureau retains criminal records and makes them available, including records about people born in the respective judicial district who have been convicted or given a substitute administrative penalty by the Bulgarian courts (regulation 2(1) and (2), amended in December 2021 to become regulation 2(1)(1) and (1)(2)). 34 .     The exchange of information with foreign criminal records authorities is carried out by the central criminal records bureau and is governed by special rules, in particular as regards the exchange of information with other member States of the European Union (see footnote 6 below). Apart from in the context of this type of exchange, the criminal records bureaux can only disclose someone’s criminal record in one of two ways: (a) by issuing a conviction certificate following a request by the person concerned or a relative of that person (since September 2022 it has also been possible for some authorities to obtain such certificates directly, in electronic form); or (b)   by issuing a criminal record report at the request of an authority entitled to obtain such a report (see paragraph 46 (a) and (b) below). Periods for the retention of criminal records 35 .     Criminal records are kept in the form of (a) conviction record cards (regulations 6-25), and (b) record cards for substitute administrative penalties (regulations 26-32). Until the end of 2021 those record cards existed in paper form only, with an electronic archive of the paper original (regulations 5(1), 8(2), 13(1) and 27(1), as worded until the end of 2021). Since the beginning of 2022 it has been necessary to keep the cards in both electronic and paper form, the paper form consisting of a printout of the electronic record (regulations 5(1), 8(2) and (3), 13(1) and 27(1)-(3), as worded since the beginning of 2022). 36 .     Each criminal records bureau must also keep an alphabetical index and an incoming register of all record cards which it has received; the index has both a paper and an electronic version (regulations 5(2), 13(1) and 28(1)). Regulation 28(1)(2), as worded initially in 2008 (and until the end of 2020), specified that the alphabetical index concerning record cards for substitute administrative penalties had to contain (a) the date and number of the respective judgment, (b) the date on which it had become final, and (c) the name of the court which had handed it down. Conviction record cards 37 .     A conviction record card must be destroyed one hundred years after the person whom it concerns has been born (regulation 24(1)). [1] The earmarking of a card for destruction is to be recorded in the alphabetical index (see paragraph 36 above), without erasing the names of the people concerned and the related data from the index itself (regulation 24(2)). Under regulation   24(1) in fine , as worded until the end of 2021, the cards were to be microfilmed before their destruction. The amending regulations, issued in July 2020, did not say what was to become of all existing microfilms. In a series of judgments given in 2015-19 in cases concerning police registration, the Supreme Administrative Court stated, obiter , that the destruction of conviction record cards in accordance with regulation 24(1) did not entail the deletion of the data that they contained (see реш. № 7769 от 26.06.2015 г. по адм. д. № 13082/2014 г., ВАС, V о. ; реш. № 12582 от 24.11.2015 г. по адм. д. № 4683/2015 г., ВАС, V о. ; реш. № 12775 от 27.11.2015 г. по адм.   д. № 15330/2014 г., ВАС, V о. ; реш. № 5563 от 11.05.2016 г. по адм.   д. № 4687/2015 г., ВАС, V о. ; реш. № 7180 от 15.06.2016 г. по адм.   д.   № 7040/2015 г., ВАС, V о. ; реш. № 10799 от 17.10.2016 г. по адм.   д. № 7455/2015 г., ВАС, V о. ; реш. № 13136 от 05.12.2016 г. по адм.   д. № 10757/2015 г., ВАС, V о. ; реш. № 13606 от 13.12.2016 г. по адм. д. № 10389/2015 г., ВАС, V о. ; реш. № 1562 от 07.02.2017 г. по адм.   д. № 12908/2015 г., ВАС, V о. ; реш. № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о. ; реш. № 15447 от 15.12.2017 г. по адм.   д. № 4813/2017 г., ВАС, V о. ; реш. № 4156 от 30.03.2018 г. по адм.   д. № 4191/2016 г., ВАС, V о. ; and опр. № 7233 от 15.05.2019 г. по адм. д. №   4329/2019 г., ВАС, V о. ). In five of those judgments, given in 2016-18 ( реш. № 7180 от 15.06.2016 г. по адм. д. № 7040/2015 г., ВАС, V о. ; реш.   № 1562 от 07.02.2017 г. по адм. д. № 12908/2015 г., ВАС, V о. ; реш.   № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о. ; реш.   № 15447 от 15.12.2017 г. по адм. д. № 4813/2017 г., ВАС, V о. ; and реш. № 4156 от 30.03.2018 г. по адм. д. № 4191/2016 г., ВАС, V о. ), the court went on to note that it could not assess whether Bulgarian law was in line with the requirements of Directive (EU) 2016/680 (see paragraphs 61 and   73-74 below), since that Directive had not yet been transposed and the deadline for its transposition had not yet expired (see paragraph 62 below). Record cards for substitute administrative penalties 38 .     Under regulation 31(1), as worded initially in 2008, a record card for a substitute administrative penalty was to be destroyed five years after the judgments imposing the penalty had become final. [2] An amendment which came into force in February 2013 extended that five-year period to fifteen years. In contrast to the position with respect to conviction record cards (see paragraph 37 above), the regulations did not prescribe that record cards for substitute administrative penalties were to be microfilmed before their destruction. [3] 39 .     As with the destruction of conviction record cards, the earmarking of a card for destruction is to be recorded in the alphabetical index (see paragraph 36 above), without erasing the names of the people concerned and the related data from the index itself (regulation 28(3), inserted with effect from February 2013). 40 .     The extension of the retention period for record cards for substitute administrative penalties from five to fifteen years threw up the question of what was to become of cards which ought to have been destroyed owing to the expiry of the five-year period before the entry into force of the amendment extending it to fifteen years. 41 .     In February 2014 the Supreme Judicial Council’s legal affairs committee resolved that cards whose five-year retention period had already expired by the time the amendment had come into force in February 2013 were to be destroyed, and those whose five-year retention period had not expired by that time were to be kept for fifteen years after their creation. 42 .     The question then arose as to what was to become of (a) the electronic archives of the record cards due for destruction and (b) the data taken from those cards and entered into the alphabetical indexes and incoming registers kept by the criminal records bureaux (see paragraphs 35-36 above). The Supreme Judicial Council’s legal affairs committee sought an opinion on the point from the Commission for the Protection of Personal Data. In that opinion ( Становище № П-2737 от 28.07.2014 г. ), given in July 2014, the Commission noted that the position of the Ministry of Justice was that the correct construction of regulation 28(3) (see paragraph 39 above) was that it required that the data taken from the record cards be retained indefinitely (unlike the cards themselves), inter alia , for the purpose of checking whether the people concerned were to be disqualified from holding certain public-sector posts. In the Commission’s view, such indefinite retention ran counter to the basic data protection principles set out in section 2(2) of the Protection of Personal Data Act 2002 (see paragraph 56 below), the proper protection of the private lives of those concerned, and the relevant international data protection standards. According to the Commission, the correct construction of regulation 31(1) (see paragraph 38 above) was that it required that the data taken from the record cards be deleted along with the cards themselves; this was the Commission’s settled position on the point. 43 .     For its part, in four nearly identically reasoned judgments given in   2014-16 (the first of which was that delivered in the applicant’s case – see paragraph 27 above), the Supreme Administrative Court held that even when the five-year period for storing record cards for substitute administrative penalties had expired, the electronic data from them were not subject to deletion, since they were to be kept in the alphabetical indexes and electronic archives of the criminal records bureaux (see paragraphs 35-36 above). In the court’s view, that was fully in line with Article 78a § 1 (b) of the Criminal Code (see paragraph 29 above), in accordance with which no one could benefit from a waiver of criminal liability more than once (see реш. № 14179 от 27.11.2014 г. по адм. Д. № 2069/2014 г., ВАС, V о. ; реш. № 4204 от   16.04.2015 г. по адм. Д. № 9350/2014 г., ВАС, V о. ; реш. № 4355 от   13.04.2016 г. по адм. Д. № 3879/2015 г., ВАС, V о. ; and реш. № 6695 от 06.06.2016 г. по адм. Д. № 5685/2015 г., ВАС, V о. ). Data records about the criminal history of third-country nationals 44 .     A new regulation 50e, which was added in December 2021 and came into force in September 2022, provides for the creation of a data record in the European Criminal Records Information System on Third-Country Nationals (ECRIS-TCN) [4] in relation to any person who has been criminally convicted or given a substitute administrative penalty in Bulgaria and is (a) a national of a State which is not a member State of the European Union (EU), (b)   a   national of both an EU member State and a non-member State, or (c)   a   stateless person or a person whose nationality is unknown. Such data records must be created even for convictions pre-dating the start of data entry into the ECRIS-TCN (regulation 50e(4)). 45 .     In accordance with regulation 50f(1) and (2), also added in December 2021 and in force since September 2022, read in conjunction with regulations   24(1) and 31(1), such a data record must be deleted when the time-limit for the destruction of the respective conviction record card has expired (one hundred years after the birth of the people concerned – see paragraph 37 above), or when the time-limit for the destruction of the respective record card for a substitute administrative penalty has expired (fifteen years after the judgment imposing the penalty has become final – see paragraph 38 above). [5] Manner of disclosing criminal records 46 .     Under regulations 4(1) and 33, a district court’s criminal records bureau can disclose someone’s criminal record in one of two ways. [6] ( a )     By issuing a conviction certificate ( свидетелство за съдимост ) following a request by the person to whom the criminal record relates or by certain relatives of that person (regulation 33(2)-(4)). Since September 2022 it has also been possible for some authorities to obtain such certificates directly, in electronic form ( електронно свидетелство за съдимост ), when by law they have to check someone’s criminal record (new regulation   35b, in force since September 2022). ( b )     By issuing a criminal record report ( справка за съдимост ). Such a report can only be sought for official purposes by the authorities empowered to do so (regulation 33(5)). Those authorities are ( i )     the criminal courts, prosecutor’s offices and investigating authorities (regulation 33(5)(1)); ( ii )     the various security services tasked with vetting people for the purpose of giving them clearance to access classified information (regulation   33(5)(2)); ( iii )     other State authorities or bodies authorised by law to obtain such data (regulation 33(5)(3)); ( iv )     foreign judicial authorities, if that is prescribed by a treaty or by EU   law (regulation 33(5)(4)); ( v )     the central criminal record authorities of other EU member States (regulation 33(5)(5)); ( vi )     foreign diplomatic or consular missions, in respect of nationals of their own States (regulation 33(5)(6)); ( vii )     (since an October 2015 amendment) the Central Electoral Commission, in respect of parliamentary candidates for the Bulgarian Parliament and the European Parliament, and candidates for President and Vice-President of the Republic, municipal councillors and mayors (regulation   33(5)(7)); and ( viii )     foreign diplomatic or consular missions,