The GDPR Chaos in Bulgaria
Although the EU Data Protection Regulation is already in place the chaos around it is getting worse every day, the institutions are not yet ready to clarify who and what personal data they can collect and when they need to ask for permission.
It is expected that at the end of the week the Health Fund will issue instructions to patients, doctors, hospitals and pharmacies about what data are required and what data is not, and in which cases, fines may be imposed. Chaos, however, is already a fact - some hospitals want patients to travel from other settlements to sign declarations of their personal data and only then give them an appointment. Pharmacies require the signing of a declaration upon the granting of any medication, partially or wholly paid by the NHIF.
The Commission for Personal Data Protection was forced to clarify a case after case since the project that it had prepared received mass criticism in the various sectors, and the time for its discussion was extended until the end of May. According to the chairman Ventsislav Karadzhov, chaos is due to reinsurance and ignorance.
"There is no need for a single phone record for an agreed day and hour by an individual to be required to come and make it on the spot, let alone collect personal data from him.I do not see here the processing of personal data in such volumes that could harm the individual in case he provides them to the hospital, "he told BNR. It is enough to collect data to understand if there is a health insurance for the patient. "Anyone who buys or receives partially or fully paid medicines under the Health Fund has a health booklet with a fixed number, and the registration of the health card number, or the identification of the person with the ID card provided, is sufficient," Karadzhov explained.
The new EU regulation on personal data threatens schools too. "We are in a position to break some rule that we do not know, so we are in a pending and wait-and-see situation," said Dian Stamatov, director of the 119th Academy "Academician M. Arnaudov".
"On a trip, for example, the school must provide personal data of pupils - their three names and ID numbers - to a third party because of their insurance," he said. According to him, it is also unclear how the different rankings will be announced, in which the three names of the pupils have been listed so far. Stamatov has decided in the lists of the accepted ones to leave only the incoming numbers of future alumni, but not their names. The first-graders in the Italian Lyceum in Gorna Banya were registered only with numbers.
According to Karadzhov, after the exams, "it is normal to provide grades and names, publishing ID numbers is unnecessary and too much".
The education ministry commented that they would instruct the educational institutions on how to act. They pointed out that there are trainings of directors on the subject of personal data. "Each school will have to designate a special person responsible for the storage of personal data," said MES. According to Stamatov, the provision for the person in question in the proposal is also not clear enough because it reveals that the new person should even have control over the director.
"We were ready to provide all sorts of explanations, however the business was not interested" said the head of the Commission for Personal Data Protection. He provided guidance based on some controversial cases while there is still a wait for the new law to be ratified and feedback.
"There will be no sanctions based on the new rules on protection of personal data in the case of investigative journalism which exposes illegal and immoral activities throughout the spectrum of society, as well as having significant public interest. However, if that data is abused for the production of sensational tabloid news - there will be fines", explained Karadzhov. The commission declared that it would decide on every publication separately. Photographers will also not need written permission to make pictures in public: " Photo shoots in public are not part of the application of the law, the people who are at the spot should be aware they might get caught on film." Karadzhov also gave an example with welcoming visitors in a hotel: " It is given that hotels should provide opportunity for their guests to fill the information by themselves - the minimum for registration is names and address. It is common that ID numbers are also collected due to the necessity of information to be given to the police in the case of inspections. However, demanding and recording information of IDs is too much", according to the head of the commission
- » How Long Can Bulgaria Keep Facing both East and West?
- » Bulgaria Must do More to Liberalise its Energy Markets
- » Euronews: Bulgaria is Open for Business
- » Visegrad/Insight: Bulgaria’s Black Mirror
- » Euractiv: Has Bulgaria’s Coal Industry Hit Rock Bottom?
- » GDPR in Bulgaria: Doctors and Employers Need no Consent for the Processing of Personal Data