Punishment against Bulgarian consulting company
The inmate of a prison was complaining to the Bulgarian regulatory authority that a company is alleged to have falsified an employment contract. The contract is said to have been concluded between the person and the company, although this has been in prison since 2003 throughout and therefore had no opportunity to sign a contract.
The data protection authority investigated the incident. The multiple request for comment was ignored by the acused company. Since the argument of the person concerned was conclusive and the defendant company did not give an opinion, although the GDPR explicitly demand for participation in investigations (see Article 31), the company was sentenced to pay a fine of 10,000 lev (approximately € 5,000,-).
Type of Issue:
Illegal data processing
Number of involved data records:
Special category of data involved:
Violation of GDPR Paragraph:
5. Principles relating to personal data processing
6. Lawfulness of processing