EU Commission launches multiple infringement procedures against Bulgaria over data protection and other breaches

The European Commission has opened five infringement procedures against Bulgaria, giving the country two months to respond. The cases concern violations of EU rules on personal data protection, the exchange of tax information, control of precursors for explosives, renewable‑energy licensing, and waste‑management targets. If the shortcomings are not remedied, the Commission may refer Bulgaria to the EU Court of Justice and impose financial penalties.

Separately, Bulgaria’s Democratic Party (DPS) has reported a large‑scale misuse of Passenger Name Record (PNR) data, claiming that over 100,000 citizens’ travel information was accessed by the Interior Ministry and shared with Interpol, Europol and other European agencies without proper legal basis. The party says the breach breaches several EU directives and the GDPR, and it has alerted foreign embassies and data‑protection authorities about the incident.