Published on 5 September 2022
FOURTH SECTION
Application no. 40519/15
Borislav Kirilov TONCHEV
against Bulgaria
lodged on 10 August 2015
communicated on 19 August 2022
STATEMENT OF FACTS
1. The applicant, Mr Borislav Kirilov Tonchev, is a Bulgarian national who was born in 1981 and lives in Lovech. He is represented before the Court by Mr A. Kashamov, a lawyer practising in Sofia.
2. The facts of the case, as submitted by the applicant and as emerging on the basis of the documents submitted by him and of publicly available records, may be summarised as follows.
The applicant’s recruitment as a prison guard3. In March 2004 the applicant applied for the position of prison guard. In support of his application, he submitted a conviction certificate (see paragraphs 37 (a) and 38 below) issued on 12 March 2004, and certificates issued again in March 2004 by the local district prosecutor’s office and investigation service, attesting that he had no convictions and sentences or substitute administrative penalties.
4. In June 2004 the applicant was appointed as a prison guard with effect from 1 July 2004.
The applicant’s substitute administrative penalty5. In the meantime, in May 2004 the applicant was caught driving his car drunk, and in September 2004 the Pleven District Court found him guilty of driving a vehicle while intoxicated but waived his criminal liability and gave him a substitute administrative penalty – a fine of 500 Bulgarian levs – in application of Article 78a of the Criminal Code (see paragraph 25 below). That judgment became final on 20 October 2004.
6. As required under the relevant regulations (see paragraphs 27 and 28 below), on 26 October 2004 a record card (бюлетин) for that penalty was drawn up and then stored in the Troyan District Court’s criminal-records bureau.
The investigation data held by the Ministry of Internal Affairs7. In 2009 the applicant asked the Ministry of Internal Affairs to erase the data that it was holding about the investigation against him. The Ministry refused, and the applicant complained to the Commission for Protection of Personal Data (see paragraph 40 below). In 2010 the Commission found that there had been no grounds to retain the data after the end of the criminal proceedings against the applicant, and instructed the Ministry to erase it.
8. The Ministry sought judicial review, but a three-member panel of the Supreme Administrative Court dismissed its claim, agreeing that there had been no grounds to retain the data after the judgment sanctioning the applicant for the offence in respect of which he had been investigated (see реш. № 14750 от 02.12.2010 г. по адм. д. № 4766/2010 г., ВАС, V о.). The Ministry appealed, but in March 2011 a five-member panel of the Supreme Administrative Court upheld the lower panel’s judgment (see реш. № 4300 от 28.03.2011 г. по адм. д. № 1750/2011 г., ВАС, петчл. с-в).
9. As a result of those proceedings, on an unspecified date in 2011-12 the data about the investigation against the applicant was apparently erased from the records of the Ministry of Internal Affairs.
The applicant’s dismissal and his legal challenge against it10. In July 2012 the Ministry of Justice opened a competition for posts in the directorate responsible for ensuring the judiciary’s security. In August 2012 the applicant applied for one of those posts. Following that application, on 14 August 2012 that directorate sought and obtained from the Lovech District Court’s criminal-records bureau a criminal-record report (see paragraphs 37 (b) and 39 below) which mentioned the applicant’s substitute administrative penalty (see paragraph 5 above). To issue the report, the Lovech bureau obtained electronically data about that penalty from the Troyan District Court’s criminal-records bureau, which was keeping the record card for the penalty (see paragraph 6 above). Based on those data, in October 2012 the applicant was not admitted to the appointment competition.
11. In the light of the data about the applicant’s penalty, in November 2012 his employer, the Chief Directorate for the Execution of Punishments, asked the Troyan District Court for a criminal-record report about him. The report, which became available on 28 November 2012, said that the applicant had no criminal record. The Chief Directorate invited the Troyan District Court to explain this discrepancy with the report issued by the Lovech District Court’s criminal-records bureau (see paragraph 10 above), and in a letter of 10 January 2013 the Troyan District Court stated that the discrepancy had been due to the destruction of the record card for the applicant’s penalty in November 2012 (see paragraphs 17 and 18 below).
12. In March 2013 the Chief Directorate dismissed the applicant from his post as a prison guard, on the basis that the criminal-record report issued by the Lovech District Court and the information from the Troyan District Court showed that he had a substitute administrative penalty, and that his remaining in that post was by law incompatible with such a penalty.
13. The applicant sought judicial review of his dismissal. He argued, inter alia, that the Chief Directorate had obtained the data about his penalty unlawfully. The only way in which an employer could access criminal-record data was by way of a conviction certificate; criminal-record reports could only be used for law-enforcement purposes.
14. In February 2014 the Sofia City Administrative Court dismissed the claim. It held, inter alia, that the fact that the data about the applicant’s penalty had been obtained via a criminal-record report issued by the Lovech bureau rather than by the Troyan bureau could not affect the lawfulness of his dismissal (see реш. № 1053 от 24.02.2014 г. по адм. д. № 9360/2013 г., АдмС-София-град).
15. The applicant appealed on points of law. He argued, inter alia, that the only proper way of ascertaining the existence of his penalty had been via data taken from the record card for that penalty, and that after the destruction of that card (see paragraph 18 below) it had been impermissible for those data to be obtained by other means.
16. On 11 February 2015 the Supreme Administrative Court upheld the lower court’s judgment. It held that by law a prison officer who had been given a substitute administrative penalty (see paragraph 25 below) had to be dismissed from his or her post. It further held that the law did not require that the data about the penalty be obtained by the employer authority in any particular way. The applicant’s arguments in that respect were hence irrelevant. It was enough that there existed a criminal-record report showing that he had been given such a penalty (see реш. № 1532 от 11.02.2015 г. по адм. д. № 5112/2014 г., ВАС, V о.).
Proceedings relating to the data about the applicant’s penalty17. Apparently in reaction to the criminal-record report issued on 14 August 2012 by the Lovech District Court’s criminal-records bureau based on the data obtained from the Troyan District Court’s criminal-records bureau (see paragraph 10 above), the applicant asked the latter to destroy the record card for his substitute administrative penalty, noting that more than five years had elapsed since the judgment imposing that penalty had become final (see paragraph 31 below).
18. On 17 August 2012 the president of the Troyan District Court appointed a committee tasked with destroying all record cards for substitute administrative penalties imposed with judgments which had become final more than five years previously. On 19 November 2012 that committee earmarked all cards which were subject to destruction, and on 5 December 2012 informed the archives that they could proceed with their destruction.
19. In the meantime, in November 2012 the applicant complained to the Commission for Protection of Personal Data (see paragraph 40 below) that in 2009-12 the Ministry of Justice had been unlawfully processing his data, since the Troyan District Court’s criminal-records bureau had kept the record card for his penalty after October 2009 despite the expiry of the five-year period for its retention (see paragraph 31 below). The applicant urged the Commission to give directions for the breach to cease and to impose sanctions in relation to it. The Commission of its own motion joined the Troyan District Court as a second respondent to the proceedings.
20. In June 2013 the Commission upheld the applicant’s complaint. It found that the retention of data about his penalty by the Troyan District Court’s criminal-records bureau after the expiry of the five-year period for keeping the record card for that penalty in October 2009 had been unlawful. The disclosure of those data to the Lovech District Court’s criminal-records bureau in August 2012 (see paragraph 10 above) had thus also been unlawful. The Commission fined the Troyan District Court for those two breaches of the Protection of Personal Data Act 2002 (see реш. № Ж-335/2012 от 26.06.2013 г., КЗЛД).
21. The Troyan District Court sought judicial review of the Commission’s decision. Following the lodging of the judicial-review claim, in July 2013 the applicant declared that he wished to withdraw his complaint to the Commission. He did not appear before the Sofia City Administrative Court and made no submissions to it.
22. In November 2013 the Sofia City Administrative Court declared the Commission’s decision null and void on the basis that its competence to give a decision pursuant to the applicant’s complaint had disappeared with retrospective effect when the applicant had withdrawn that complaint (see реш. № 7373 от 26.11.2013 г. по адм. д. № 7597/2013 г., АдмС-София-град).
23. The Commission appealed on points of law. The applicant took no part in the appeal proceedings either.
24. On 27 November 2014 the Supreme Administrative Court upheld the lower court’s judgment. It held that the Commission had erred by fining the Troyan District Court, since the applicant’s complaint had been directed solely against the Ministry of Justice. The Commission had also been wrong to find that the Troyan District Court had been processing the applicant’s data unlawfully. That court had been doing so for lawful purposes, and had not retained the data in breach of a relevant time-limit. Although under the applicable regulation a record card for a substitute administrative penalty was to be destroyed five years after the judgment imposing that penalty had become final (see paragraph 31 below), there was no provision for the data from that card to be erased as well; they were to be retained in both the alphabetical index and the electronic archive kept by the competent criminal-records bureau (see paragraphs 28 and 29 below). This was fully in line with Article 78a § 1 (b) of the Criminal Code, according to which no-one could benefit from a waiver of criminal liability more than once (see paragraph 25 below). All that was grounds to quash the Commission’s decision, not to declare it null and void, but since the effects of those two ways of disposing of the case were identical, there was no reason to disturb the lower court’s judgment (see реш. № 14179 от 27.11.2014 г. по адм. д. № 2069/2014 г., ВАС, V о.).
RELEVANT LEGAL FRAMEWORK
Replacement of criminal liability with an administrative penalty25. In some circumstances, Article 78a §§ 1 and 4 of the Criminal Code requires the courts to waive a convicted person’s criminal liability and replace it with an administrative penalty. According to Article 78a § 1 (b), that possibility is available only once, but the former Supreme Court and the Supreme Court of Cassation have held that it can become available again if more than one year has passed since the execution of the first such administrative penalty or the expiry of the limitation period for its enforcement (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4, and тълк. реш. № 2 от 28.02.2018 г. по тълк. д. № 2/2017 г., ВКС, ОСНК, т. 7 и 8). The former Supreme Court has clarified that people who have been given such a substitute administrative penalty are considered not to have been criminally convicted (see пост. № 7 от 04.11.1985 г. по н. д. № 4/1985 г., ВС, Пл., т. 4).
26. People sanctioned under Article 78a of the Criminal Code cannot serve as officers in the National Security Service (section 39(3)(1) of the National Security Service Act 2015) or as forest guards (section 198(2)(2) of the Forests Act 2011). Until mid-2014, they could not serve as officers in the Ministry of Internal Affairs either (section 179(1)(2) of the Ministry of Internal Affairs Act 2006, repealed in 2014, and its predecessor, section 193(1)(2) of the Ministry of Internal Affairs Act 1997).
Retention and disclosure of criminal recordsAuthority tasked with retaining and disclosing criminal records27. The retention and disclosure of data about convictions and substitute administrative penalties (see paragraph 25 above) is governed by Regulations no. 8 of 2008 of the Minister of Justice (Наредба № 8 от 26.02.2008 г. за функциите и организацията на дейността на бюрата за съдимост). Under those regulations, there is a criminal-records bureau attached to each district court, plus a Central Criminal-Records Bureau (regulations 2 and 3; see also section 77(3) and (4) of the Judiciary Act 2007). Each bureau retains and makes available criminal records about people born in the respective judicial district who have been convicted by the Bulgarian courts or given a substitute administrative penalty (regulation 2(1)).
Periods for the retention of criminal records28. Criminal records are retained in the form of (a) conviction record cards (regulations 6-25), and (b) record cards for substitute administrative penalties (regulations 26-32). Until the end of 2021, those record cards were in paper form only, with an electronic archive of the paper original (regulations 5(1), 8(2), 13(1) and 27(1), as worded until the end of 2021). Since the beginning of 2022, the cards are to be kept in both electronic and paper form, the paper form consisting of a printout of the electronic record (regulations 5(1), 8(2) and (3), 13(1) and 27(1)-(3), as worded since the beginning of 2022).
29. Each criminal-records bureau must also keep an alphabetical index and an incoming register of all record cards which it has received; the index has both a paper and an electronic version (regulations 5(2), 13(1) and 28(1)).
(a) Conviction record cards
30. Conviction record cards must be destroyed one hundred years after the people whom they concern have been born (regulation 24(1)).[1] By regulation 24(1) in fine, as worded until the end of 2021, the cards had to be microfilmed before their destruction. The amending regulations, issued in July 2020, did not say what was to become of all existing microfilms. The Supreme Administrative Court has noted on a number of occasions that the destruction of conviction record cards in application of regulation 24(1) does not entail the erasure of the data that they contain (see реш. № 7769 от 26.06.2015 г. по адм. д. № 13082/2014 г., ВАС, V о.; реш. № 12582 от 24.11.2015 г. по адм. д. № 4683/2015 г., ВАС, V о.; реш. № 12775 от 27.11.2015 г. по адм. д. № 15330/2014 г., ВАС, V о.; реш. № 5563 от 11.05.2016 г. по адм. д. № 4687/2015 г., ВАС, V о.; реш. № 7180 от 15.06.2016 г. по адм. д. № 7040/2015 г., ВАС, V о.; реш. № 10799 от 17.10.2016 г. по адм. д. № 7455/2015 г., ВАС, V о.; реш. № 13136 от 05.12.2016 г. по адм. д. № 10757/2015 г., ВАС, V о.; реш. № 13606 от 13.12.2016 г. по адм. д. № 10389/2015 г., ВАС, V о.; реш. № 1562 от 7.02.2017 г. по адм. д. № 12908/2015 г., ВАС, V о.; реш. № 15101 от 08.12.2017 г. по адм. д. № 6663/2016 г., ВАС, V о.; реш. № 15447 от 15.12.2017 г. по адм. д. № 4813/2017 г., ВАС, V о.; реш. № 4156 от 30.03.2018 г. по адм. д. № 4191/2016 г., ВАС, V о.; and опр. № 7233 от 15.05.2019 г. по адм. д. № 4329/2019 г., ВАС, V о.).
(b) Record cards for substitute administrative penalties
31. Under regulation 31(1), as worded initially in 2008, record cards for substitute administrative penalties were to be destroyed five years after the judgments to which they related had become final.[2] With effect from 15 February 2013, that five-year period was extended to fifteen years. In contrast to the position with respect to conviction record cards (see paragraph 30 above), the regulations did not prescribe that record cards for substitute administrative penalties had to be microfilmed before their destruction.[3]
32. The data relating to record cards for substitute administrative penalties in the alphabetical indexes kept by the criminal-records bureaus (see paragraph 29 above) are, for their part, not subject to erasure (regulations 24(2) and 28(3), the latter inserted with effect from 15 February 2013).
33. The extension of the retention period for record cards for substitute administrative penalties from five to fifteen years threw up the question what was to become of cards which ought to have been destroyed owing to the expiry of the five-year period before the entry into force of the amendment extending it to fifteen years.
34. On 17 February 2014 the Supreme Judicial Council’s legal-affairs committee resolved that cards whose five-year retention period had expired by the time when the amendment had come into force on 15 February 2013 were to be destroyed, and those whose five-year retention period had not expired by that time were to be kept for fifteen years after their creation.
35. The question then arose what was to become of the electronic archives of the record cards due for destruction and of the data taken from them and entered into the alphabetical indexes and incoming registers kept by the criminal-records bureaus (see paragraphs 28 and 29 above). The Supreme Judicial Council’s legal-affairs committee sought an opinion on the point from the Commission for Protection of Personal Data. In that opinion (Становище № П-2737 от 28.07.2014 г.), issued in July 2014, the Commission noted that the position of the Ministry of Justice was that under a proper interpretation of Regulations no. 8, the data taken from the record cards were to be retained indefinitely (in contrast to the cards themselves). In the Commission’s view, however, such indefinite retention ran counter to data-protection principles and to the proper protection of the private lives of those concerned. For the Commission, the data taken from the record cards had to be erased alongside the cards.
36. For its part, in four nearly identically reasoned judgments given in 2014-16 (the first of which was that in the applicant’s case – see paragraph 24 above), the Supreme Administrative Court held that even when the five-year period for storing record cards for substitute administrative penalties expired, the data from them were not subject to erasure, since they had to be kept in the criminal-records bureaus’ alphabetical indexes and electronic archives (see paragraphs 28 and 29 above). In the court’s view, that was fully in line with Article 78a § 1 (b) of the Criminal Code (see paragraph 25 above), according to which no-one could benefit from a waiver of criminal liability more than once (see реш. № 14179 от 27.11.2014 г. по адм. д. № 2069/2014 г., ВАС, V о.; реш. № 4204 от 16.04.2015 г. по адм. д. № 9350/2014 г., ВАС, V о.; реш. № 4355 от 13.04.2016 г. по адм. д. № 3879/2015 г., ВАС, V о.; and реш. № 6695 от 06.06.2016 г. по адм. д. № 5685/2015 г., ВАС, V о.).
Manner of disclosing criminal records37. By regulations 4(1) and 33, a district court’s criminal-records bureau can disclose someone’s criminal record in one of two ways:
(a) By issuing a conviction certificate pursuant to a request by the people concerned. From September 2022, it will in addition be possible for some authorities to obtain such certificates directly, in electronic form, when by law they have to check someone’s criminal record (new regulation 35b, due to come into effect in September 2022). This latter possibility will be open solely with respect to people who have neither a conviction record card nor a record card for a substitute administrative penalty (regulation 35b(1));[4] or
(b) By issuing a criminal-record report. Such a report can only be sought for official purposes by the authorities empowered to do so (regulation 33(5)). Those include (i) the criminal courts, the prosecutor’s offices and the investigating authorities; (ii) the various security services tasked with vetting people for the purpose of clearance to access classified information; (iii) other State authorities or bodies authorised by law to obtain such data; (iv) foreign judicial authorities (if that is prescribed by a treaty or by European Union law); (v) the central criminal-record authorities of other member States of the European Union; and (vi) foreign diplomatic or consular missions, in respect of nationals of their own States.
38. A conviction certificate only contains data about convictions (regulation 39(1)). It must moreover not mention any convictions for offences in respect of which the person concerned has been rehabilitated (regulation 39(2)(2)), unless a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, but in that case the certificate must specifically mention that the person concerned has been rehabilitated and set out the date of that rehabilitation (regulation 39(3)).
39. A criminal-record report contains data about both convictions and substitute administrative penalties (regulation 40(1)). It must mention all convictions, irrespective of rehabilitation (regulation 36(2)). A new regulation 36b, added in 2020 and due to come into effect in September 2022, carved out a limited exception to that general rule: if the criminal-record report is requested by a State authority or body of the type mentioned in paragraph 37 (b)(iii) above, it must not mention any substitute administrative penalties or any convictions in respect of offences for which the person concerned has been rehabilitated (except if a statute expressly provides that rehabilitation does not wipe out all effects of the conviction, in which case the criminal-record report must specifically mention that the person concerned has been rehabilitated and set out the date of that rehabilitation).
Remedies in respect of allegedly unlawful data processingUntil February 201940. At the relevant time and until February 2019, section 38(1) of the Protection of Personal Data Act 2002 provided that anyone could complain to the Commission for Protection of Personal Data of a breach of his or her rights under the Act. The Commission’s powers in such proceedings were to (a) give directions to the data controller, (b) fix a time-limit for the breach to be put right, or (c) impose an administrative penalty (section 38(2), as worded until February 2019). In cases of processing of personal data for the purposes of national defence, national security, public order or criminal proceedings, the Commission’s powers were limited to declaring whether the processing was lawful (section 38(5), currently section 38(6)). The Supreme Administrative Court has held that in such cases the Commission could not prescribe any remedial measures, but the case was to be referred back to the relevant authority for it to decide how to proceed based on the Commission’s findings (see реш. № 13202 от 03.12.2008 г. по адм. д. № 10153/2008 г., ВАС, петчл. с-в). The Commission’s decision was amenable to judicial review (section 38(6), currently section 38(7)).
41. Aggrieved individuals could alternatively seek judicial review of the data controller’s decisions or actions, plus damages (section 39(1) and (2), as worded until February 2019). That remedial avenue could not be used if the person concerned had turned to the Commission, until the proceedings before the Commission (and any proceedings for judicial review of its decision) had ended (section 39(4), as worded until February 2019).
Since February 201942. In February 2019, when the Protection of Personal Data Act 2002 was brought into line with the General Data Protection Regulation (“GDPR”) and Directive (EU) 2016/680, that system of remedies was retained (except with respect to data processing by the courts and the prosecuting and investigating authorities for law-enforcement purposes), but the Commission’s powers were harmonised with Article 58 § 2 (a)-(h) and (j) of the GDPR (sections 38(3) and 82(1) of the Act, as worded since February 2019).
43. Since February 2019, the administrative remedy in respect of data processing by the authorities for law-enforcement purposes has been a complaint to the Inspectorate attached to the Supreme Judicial Council (sections 38b(1) and 82(1), as worded since February 2019). The judicial remedy remains a claim for judicial review of the data controller’s or data processor’s decisions or actions, possibly coupled with a claim for damages (sections 39(1) and (2) and 82(1), as worded since February 2019). The bar on parallel proceedings before the Commission, respectively the Inspectorate (and any proceedings for judicial review of their decisions), and judicial-review proceedings against the data controller remained (section 39(4) and (5), as worded since February 2019).
COMPLAINT
44. The applicant complains under Article 8 of the Convention of the retention of data about his substitute administrative penalty and their actual and potential disclosure.
QUESTIONS TO THE PARTIES
1. So far as the applicant complains under Article 8 of the Convention about the actual disclosure of the data about his substitute administrative penalty under Article 78a of the Criminal Code in 2012-13 (see paragraphs 10 and 11 of the Statement of facts), did he comply with the six-month time-limit under Article 35 § 1 of the Convention (see, mutatis mutandis, M.C. v. the United Kingdom, no. 51220/13, § 36-37, 30 March 2021)? In particular, which was the “final decision” relating to this aspect of his complaint: the Supreme Administrative Court’s judgment of 27 November 2014 or the same court’s judgment of 11 February 2015 (see paragraphs 16 and 24 of the Statement of facts)?
2. Has there been a breach of Article 8 of the Convention?
2.1. More specifically, was the retention and the actual and potential disclosure of the data about the penalty “in accordance with the law” – in the light of, in particular, the varying opinions of different domestic authorities on whether:
(a) the record cards for such penalties whose five-year retention period had expired when the relevant regulations were amended to extend that period to fifteen years in February 2013 were to be destroyed; and
(b) the electronic data from such record cards were to be retained irrespective of the destruction of the cards themselves?
2.2. Also, was the retention and the actual and potential disclosure of those data “necessary in a democratic society” to attain a legitimate aim – in the light of, in particular, the apparently indefinite retention of their electronic version?
[1]. The retention period under the previous regulation – regulation 21(1) of Regulations no. 1 of 2000 of the Minister of Justice – was one hundred years as well.
[2]. Under the previous regulation – regulation 45(1) of Regulations no. 1 of 2000, as originally worded – those record cards had to be kept for two years after the imposition of the penalty. In August 2005 regulation 45(1) was amended with effect from the beginning of 2006 to prescribe that those record cards were likewise to be kept for one hundred years after the birth of the people whom they concerned.
[3]. Under the previous regulation – regulation 45(1) read in conjunction with regulation 21 of the Regulations no. 1 of 2000 – record cards for administrative penalties could be microfilmed before their destruction if that was considered necessary by a special expert committee.
[4]. In an opinion given in January 2018 (Становище № НДМСПО-10-1/2018 г.), the Commission for Protection of Personal Data noted that this would make it possible to find out indirectly whether someone has a substitute administrative penalty, even though such penalties are not to be mentioned in conviction certificates but only in criminal-record reports (see paragraphs 38 and 39 above), and would thus run counter to the principles of data minimisation and lawfulness. In its response, the Ministry of Justice stated that the automated system for issuing such certificates could only function without human intervention if no record cards whatsoever exist with respect to the person concerned, and on that basis refused to alter the text of regulation 35b(1).