IME

In the beginning of 2002 in the State Gazette was published the Personal Data Protection Law, which “sets out regulations for the protection of individuals with regard to the processing of personal data, and the access to such data”. The law was enacted on January 1, 2002 (although it was published on January 4, 2002). Haw did the things developed after that?

1. According to section 2 of the Transitional and Concluding Provisions of the law the Council of Ministers must propose to the Parliament the members of the Personal Data Protection Commission within one month after the enactment of the law. That did not happen – the members were proposed on May 9, 2002, with a delay of more than three months.

2. The Parliament voted the members on May 23, 2002, in the last day of the 14-days’ limit, given by the law. As members of the commission were selected Ivo Stefanov (chairman), Stanimir Tzvetkov, Krassimir Dimitrov, Evgeniy Radev and Rady Romansky.

3. Within three months after the members of the commission were voted by the Parliament, the Personal Data Protection Commission had to approve and publish in the State Gazette the Statute book on its activities and the activities of its administration. However, the Statute book was published in the State Gazette on January 31, 2003, i.e. with a delay of five months.
The total delay from the late selection of the commission’s members and the late approval of the Statute book is eight months. Anyway, two weeks after the Statute book was published it was amended.

4. The commission’s Statute book stipulates a total staff of 76 people (see table 1). However, this personnel is not completed – at the moment 1/7 of the staff was hired.

Table 1: Personnel of the Personal Data Protection Commission

Total number of personnel	76
1. Members of the commission	5
1.1. Chairman	1
1.2. Members	4
2. Secretary General	1
3. General Administration	20
3.1. Department “Financial, Economic and International Activities”	20
4. Specialized administration	50
4.1. Legal Department	20
4.2. Program-technical Department	18
4.3. Information Department	12

Source: Regulations for Personal data Protection Commission activity and its administration

5. Looking at the international experience we se that the staff of the respective bodies is lower than Bulgaria (see table 2). In Sweden’s Datainspektionen the staff consists of 40 people (Swedish population is 1 million more than Bulgarian). In Ireland in the Office of the Data Protection Commissioner only 16 people are employed, and in New Zealand in the Office of the Privacy Commissioner work about 30 people, but some of them are part-time employees. Obviously, the personnel of the Bulgarian commission is at least two times higher than needed.

Table 2: International Comparison of the Personnel

Sources: Statute book on the activities of the Personal Data Protection Commission and its administration, Fourteenth Annual Report of the Data Protection Commissioner (Ireland), 2002, Annual Report of Privacy Commissioner (New Zealand) for the year ended 30 June 2002, Datainspektionen (Sweden), International Financial Statistics, November, 2003, national statistics institutes

6. In the first half of December 2003 the Personal Data Protection Commission became popular because it bought automobiles BMW, latest model from 5th series, for 300 000 levs* (which is 1/3 of its annual budget). The justification of Krassimir Dimitrov from the commission was “The money was for capital expenditures and there were two possibilities – to send them back or to buy automobiles”. The view of the commission that it is natural to spend the saved money at the end of the year, instead of returning it to the budget, shows at least three things:

· The commission cannot understand that it is moral, just and responsible to return the money that is not spent and not to spend them.
· There is not a single reason for the government employees to use expensive limousines.
· There are distorted incentives in the public sector toward spending. One of the means to change them is to treat the capital expenditures from the budget as a credit from the budget that has to be services (with payment of interest) by the body that used the public money. Similar approach is used in New Zealand.

7. The Personal Data Protection Commission obliged without any reason hundreds of thousands people to declare that they are administrators of personal data. It doesn’t seem that the commission understands the huge cost imposed by this obligation. However, after a long delay, the commission announced that maybe that requirement would be changed.

The efficient administration, that reaches some reasonable goals at the lowest possible cost and the least obstacles before the people and business is of great importance for the economic development. In the case of the Personal Data Protection Commission that is not the case.

* The exchange rate of the lev is 1.96 Levs per 1 Euro. It is fixed under a Currency Board Arrangement.

Table 2: International Comparison of the Personnel

New Zealand