www.ciela.net
Author
Annotation
The article examines the EU legal framework for personal data protection (the Charter of Fundamental Rights and the GDPR) in the context of digitalisation, automation and artificial intelligence. The author highlights inconsistencies between the definitions of “biometric data” in Bulgarian legislation and in the GDPR, and discusses the difficulties of exercising data subject rights, such as the “right to be forgotten”, when data is processed by AI systems. The main focus is Article 22 GDPR on automated individual decision-making, including profiling; the author criticises the vagueness of the phrase “similarly significantly affects” and the inaccuracy of the Bulgarian translation. The article analyses Ruling No. 10632/2024 of the Supreme Administrative Court and the CJEU judgment in Case C-634/21 (Schufa), which held that automated credit scoring is in itself a “decision” within the meaning of Article 22 GDPR. The author concludes that in Bulgaria unilateral acts of organisations providing public services are individual administrative acts, but that the broad interpretation of Article 22 GDPR places a bureaucratic burden on business, which the national legislator should limit within the permissible bounds.
Keywords
personal data protection; GDPR; automated individual decision-making; profiling; artificial intelligence
