Under the provisions of Ordinance No. 4, which determines the documents required for the conclusion of an employment contract, a criminal record certificate is required only in cases where a law or other statutory act provides for an obligation to certify the criminal record of the job applicant. This requirement is specifically laid down for holding certain positions or practising specific professions and activities for which the legislation considers certification of the criminal record to be necessary. Examples of such provisions are contained in various statutory acts, such as:

  • the Private Security Activities Act;
  • the Road Transport Act;
  • Ordinance No. 34 on the taxi transport of passengers;
  • Ordinance No. 33 on the public transport of passengers and goods in Bulgaria, and other statutory documents that introduce specific rules requiring a criminal record certificate for certain positions.
Previous Rules on Requiring a Criminal Record Certificate

A criminal record certificate was also required for certain positions before the repeal of Decree No. 1074 by Ordinance No. 63, which restricted the holding of accounting, materially accountable and other positions by persons with prior convictions. The requirement for a criminal record certificate applied to candidates who would:

  • Hold positions connected with the collection, storage or accounting of monetary and material assets;
  • Exercise such functions in fact, without being appointed to a specific position;
  • Manage or dispose of those assets;
  • Carry out financial control over funds and assets.

With the repeal of Decree No. 1074 in Issue No. 18 of 28 February 2020, Ordinance No. 63 ceased to be in force, and this changed the requirements for criminal record certificates for candidates for the aforementioned positions.

Legal Basis for Processing Personal Data from a Criminal Record Certificate

Where the obligation to provide a criminal record certificate is expressly provided for by law, the employer is entitled to process the personal data contained in that document on the basis of 'compliance with a legal obligation' under Article 6(1)(c) of the General Data Protection Regulation (GDPR).

Employer Practice and Cases of GDPR Infringement

In practice, it is common for employers to require a criminal record certificate also from candidates for positions for which there is no express statutory basis for such a requirement. The aim of these employers is to establish whether the person is suitable for the position, for example in positions such as 'driver', where the employer is interested in whether the candidate has been convicted of transport-related or other offences. In addition, some international companies are beginning to require their Bulgarian partners to carry out reliability checks on their employees who handle personal data, including through a check of their criminal record. This, in turn, is part of the measures that foreign companies apply as part of their compliance with the GDPR.

Legitimate Interest as a Basis and the Position of the КЗЛД

In these cases, where no statutory act exists requiring the presentation of a criminal record certificate, some employers cite 'legitimate interest' under Article 6(1)(f) of the GDPR as the basis for processing this personal data. This, however, was declared by the Commission for Personal Data Protection (КЗЛД) to be contrary to the Regulation.

In its opinion with ref. No. ПНМД–10-5/16.01.2020, the КЗЛД ruled that, for the purposes of concluding an employment contract, the employer may process personal data from the criminal record certificate only where the basis of 'compliance with a legal obligation' under Article 6(1)(c) of the GDPR applies. This means that the requirement must derive from a statutory act, such as Ordinance No. 4 on the documents required for an employment contract (Article 1, paragraph 1, point 5). Otherwise, the processing of personal data from a job applicant's criminal record certificate is unlawful.

Should you require assistance in drafting documents or a consultation in the field of personal data protection, contact us by telephone: 0887550706 or by e-mail: [email protected]