Bulgaria
Credit Reporting System
c. BNB’s Central Credit Register is subject to oversight by BNB’s internal auditors, per BNB’s internal rules and procedures. Private credit bureaus are subject to annual external audits as well as supervision and/or audits by the Commission for Personal Data Protection. d. While Ordinance No. 22 is silent on a role of voluntary organizations with respect to confidentiality of information in a credit register or bureau, the Consumer Protection Act affirms that citizens may associate into consumer associations for the purpose of protection of the rights and interests of consumers. This law provides that consumer associations shall be entitled to “inform the control authorities of any cases in which the rights of consumers are violated.” However, with respect to court actions, the law entitles consumer associations to “approach the court on violations of the rights and interests of consumers in the cases and under the terms established by this Act” (article 169, emphasis added). Because bank secrecy or other confidential consumer data are not specifically covered in the Consumer Protection Act, it is not clear that a consumer association could address such cases in court. At the same time, the law provides that consumer associations “may bring an action for cessation or for prohibition of any acts or commercial practices which infringe on the collective interests of consumers” (article 186, emphasis added). e. Interagency consultation is not required by law. The Law on Personal Data Protection and Ordinance No. 22 are silent on inter-agency coordination and interaction (e.g. between BNB and the Commission for Personal Data Protection). f. The Central Credit Register was established by Ordinance No. 22, and no separate registration or license is required. Private credit bureaus are required to register and obtain a license from the Commission for Personal Data Protection. Recommendation
The annual reports of the private credit bureaus should be reviewed by the Commission for Personal Data Protection, BNB and FSC on a no objection basis. The annual reports of each credit bureau should be published on the bureau’s website and disseminated via financial institutions branches as part of a program on raising awareness and educating financial consumers about the credit bureaus’ activities and performance. The Commission for Personal Data Protection should publish, in a consolidated manner, information on the complaints concerning violation of personal data protection in financial services to inform and educate the public in the area of financial services. It is recommended that BNB and the Commission for Personal Data Protection consult and possibly sign a memorandum of understanding to ensure that the Central Credit Register meets all security requirements that the Commission oversees in private credit bureaus, and that systems of banks and credit bureaus meet the requirements under laws and regulations of both BNB and the Commission.
SECTION B
CONSUMER EMPOWERMENT
Good Practice B.1
Information Resources for Consumers Financial regulators should devise, publish and distribute information resources for consumers that seek to improve their knowledge of actively managing the credit report.
Description
The law is silent on this, and the Central Credit Register is not actively involved in this. The websites of the Register and private credit bureaus do not include information for consumers on their rights, or procedures to obtain a copy of the information that the Register maintains on them. Nor is such information distributed through banks and other subscribers.
Recommendation
The Central Credit Register, as a public institution, should have a clearly defined budget for raising awareness of the public about the importance of good credit history and its impact on the borrowing cost and access to finance. Also, the Central Credit Register and private credit bureaus should, in cooperation with the Commission for Personal Data Protection, inform and educate the public about possible threats regarding misuse of personal data in
69