site.btaSofia Court Withdraws National Revenue Agency Sanction for Personal Data Leakage

Sofia City Administrative Court (SCAC) withdraws the sanction imposed on the National Revenue Agency (NRA) over the personal data leaks of 2019, said the court on Monday. The court closes the administrative penalty proceedings, initiated on an appeal by the National Revenue Agency against a fine of BGN 5,100,000. 

The court reasons that the period of prescription, which in this case is four and a half years, has expired.

The decision is final and unappealable.

The penalty was imposed on the NRA for the data leaked in a hacking attack in July 2019, when the data of nearly five million citizens became public. 

The fine of BGN 5,100,000 was imposed by the Commission for the Protection of Personal Data back in August 2019, but the NRA appealed it before the Sofia Regional Court, which decided to fully uphold the penalty ruling only at the end of 2023.

The NRA data leak became public knowledge on July 16, 2019, when emails were sent to media by an "anonymous Russian hacker" claiming to be the attack's author. The attack was subsequently blamed on terrorism and a criminal group with a self-serving purpose formed by the owner of the TAD GROUP, Ivan Todorov, the company's employee Kristian Boykov and commercial director Georgi Yankov. The latter was considered an instigator along with Todorov. The case was submitted to the Sofia City Court at the beginning of 2023 but has since been returned to the prosecution service twice.