The Applicability of the Eu Data Protection Rules in the Area of National Security in the Republic of Bulgaria

The key acts shaping the EU data protection legal regime – the General Data Protection Regulation 2016/679 (GDPR) and the Law Enforcement Directive 2016/680 (LED) – explicitly stipulate that they do not apply in areas which fall outside the scope of EU law, such as activities concerning national security (recital 16 and 14 respectively). At the same time, Bulgarian legislation gives a very broad definition of “national security” as a dynamic state of society and the state in which values such as the territorial integrity, sovereignty and the constitutionally established order of the country are protected, and where the democratic functioning of institutions and the fundamental rights and freedoms of citizens are guaranteed. As a result, a variety of competent authorities contribute daily to the protection of these values such as the leading authorities from the legislative and executive power, the president, the law enforcement agencies, the courts, the various regulators, etc. A lot of the data processing activities of these authorities conducted while exercising their powers actually do fall into the scope of the GDPR and the LED and at the same time serve the protection of the national security. To that end, a strict dividing line between national security and other activities of these bodies often cannot be drawn. The present paper argues that the GDPR and the LED should apply to a lot of the activities contributing to the protection of national security which will also be an additional safeguard for the fundamental rights and interests of the individuals and increase the accountability of the competent authorities.