KEY TAKEAWAYS FROM THE MOST SIGNIFICANT GDPR PERSONAL DATA BREACHES IN THE REPUBLIC OF BULGARIA

Abstract

The present research paper focuses on the most significant personal data breaches under the EU General Data Protection Regulation 2016/679 (GDPR) that took place in the Republic of Bulgaria since the GDPR became applicable in 2018. These include inter alia the data breaches that affected the National Revenue Agency, the Bulgarian Posts, one of the Bulgarian banks and other organizations from the public and the private sector. The analysis of these cases is important, because they had an impact on thousands and sometimes millions of people and resulted in severe sanctions reaching thousands and sometimes millions of Bulgarian leva. This problem is especially relevant in the modern information society where the collection and processing of data are fundamental for the economic growth and societal well-being. By examining the available public documentary sources on these cases such as the practice of the Bulgarian Commission for Personal Data Protection Commission the authors aim to derive key takeaways regarding the reasons for these data breaches, the gaps in the data protection and information security practices of the affected organizations and possibly to synthesize recommendations and advice for the future how such breaches could be avoided or at least mitigated. These results will play a valuable part in a broader scientific research project dedicated to management of the data breach response reaction processes of the Bulgarian organizations funded by the Bulgarian Science Fund with the Ministry of Education where the authors form the research team.