Pursuant to a legal opinion[1] issued by the Bulgarian Commission of Personal Data Protection (“CPDP”), transfer of personal data in relation to assignment of receivables falls under the scope of applicability of the legitimate interests of the data controller as one of the grounds for the lawful processing of personal data. During the last several years the practice of assignment of receivables to “bad debt” collectors has become quite common in Bulgaria, especially for commodities providers. With the said decision, the CPDP resolved the long debated question whether in the absence of an express consent from consumers their personal data could be transferred legitimately to third parties for the purposes of assignment of receivable or such practice is prohibited on data privacy considerations (i.e. the personal data may not be provided to third parties, including to the assignee under a contract for assignment of receivables). According to the CPDP, the processing of personal data of consumers by the assignee, pursuant to a contract for assignment of receivables, is acceptable and lawful, when effected for the purposes of protection of the legitimate interests of the assignee. In the opinion of the CPDP, the express consent of the data subjects is not a requirement for the lawfulness of the processing of personal data by the assignee. The CPDP further says that in cases of assignment of receivables, the assignee is not required to provide information to the data subjects regarding the processing of their data, to the extent the data subjects have already been provided with the required information by the assignor. In the same opinion the CPDP states that the existence of a valid contractual relationship between the data controller (assignor) and the consumer, whose personal data is being processed, is sufficient as ground for the lawful processing of his/her personal data by the assignee for the purposes of performance of a contract, to which the data subject is a party. Accordingly, this is a separate ground justifying the lawfulness of processing of personal data of consumers by the assignee under a contract for transfer of receivables.

[1] Legal Opinion reg. No. П-233/2014 of 13.03.2014
Previous articleFirst decision on “no spy guarantee” issued by German Federal Public Procurement Chamber
Next articleExistence of Compliance Program Will Not Lessen Punishment for Cartel Violations: US Antitrust Enforcers