site.btaUPDATED District Court Upholds BGN 5 Million Fine for Personal Data Leak from NRA System

The Sofia District Court has upheld the fine of BGN 5.1 million imposed on the National Revenue Agency by the Commission for Personal Data Protection, BTA learned from the court on Friday.

The sanction was imposed for the leaked data in the hacking attack in 2019. The decision of the Sofia District Court is subject to appeal.

The court reminds that it is ultimately the failure to apply the relevant appropriate technical measures, and not the unauthorised access to personal data, that is sufficient grounds for sanctions.

It is absolutely clear and undisputed that the NRA processes personal data, and the appropriate technical measures should have been taken to protect it, the court said.