ON THE NEED FOR REGULATORY CHANGES IN RELATION TO THE IMPLEMENTATION OF THE NEW PERSONAL DATA PROTECTION REGULATION (GDPR)

TO

Mr. Boiko Borisov

PRIME MINISTER OF THE REPUBLIC OF BULGARIA

RESPONSE: Provision of up-to-date information on the current status of national legislation in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (ARDP)

Dear Mr. Borisov,

From 25 May 2018, the application of the General Regulation on the protection of personal data (Regulation (EC) 2016/679) starts. The regulation directly affects all state and municipal structures, public organizations, non-profit organizations, as well as all business entities that collect, process and store personal data in the course of their activities. In general, complying with the requirements of the regulation will require a change in the company's internal organization, and some of them will have to make substantial changes to avoid being sanctioned.

Despite the direct application of the Regulation, part of the texts delegate to the Member States the power to regulate part of the rules independently. At present, the basic legal act in the field of personal data protection is the Personal Data Protection Act and the secondary legislation issued on the basis of the legal delegation therein. Undoubtedly, national legislation should be revised in the light of new European regulation.

In this regard, the Bulgarian Industrial Association expresses its concern that the draft legislative and operational program of the Council of Ministers until June 2018 did not include a draft Law on Amendment and Supplement to the Personal Data Protection Act. This is also not published on the public consultation portal.

Despite the large-scale information campaign organized by the Personal Data Protection Commission, the lack of information on specific legislative changes at national level creates prerequisites for speculation, spreading false information from various sources, and prevents companies from adequately preparing and meeting the requirements.

In view of the above, I would ask you to exercise your influence by taking all the measures, including legislation, for the successful implementation of Regulation (EC) 2016/679.

WITH RESPECT,

BOJIDAR DANEV

Executive Chairman