Category: Bulgaria

May 2023 marks five years since the application of the General Data Protection Regulation, better known as “GDPR”, and its requirements still pose a number of challenges for organizations. On one hand, this is because ensuring compliance with GDPR is not a “one-time exercise” but a continuous process “from within”, requiring synchronization with all other activities in the organization. On the other hand, companies must also take into consideration innovations “from the outside”, including new regulations and technologies, by promptly addressing data protection risks.

Did you know that the word “risk” is used 76 times in the GDPR? The risk to an organization is greater the larger the data sets it processes, especially if data is “sensitive”, i.e. a special category of personal data. These include, for example, health data processed in clinical trials.

In the field of clinical trials, in early 2022, Regulation (EU) 536/2014 on clinical trials on medicinal products for human use began to apply, the provisions of which are in close interaction with the rules of the GDPR. How do the two regulations relate to each other? This question is answered by the European Commission (“EC”) and the European Data Protection Board (“EDPB”). They also guide the parties involved in the trials (sponsor, clinical trial site, principal investigator, etc.) about the basis for processing patients’ personal data in different hypotheses.

Patient protection in clinical trials 

Both the Clinical Trials Regulation and the GDPR are aimed at strengthening the protection of patients’ rights, but from different perspectives. The Clinical Trials Regulation aims to obtain reliable and robust data in the clinical trial, protecting the rights, safety, dignity and well-being of individuals. On the other hand, the GDPR ensures the protection of their personal data.

In the Clinical Trials Regulation, one of the highlights is the issue of the patient’s informed consent with which they freely and voluntarily expresses their willingness to participate, after detailed information on all aspects of the clinical trial. This consent is a condition for inclusion in a clinical trial, but it should not be confused with consent as a basis for processing personal data within the meaning of the GDPR, which is not always necessary because the data may be processed on another basis (e.g. a legal obligation).

On what grounds is patient data processed?

The European Commission divides the volume of data processed in the course of a clinical trial into two groups – data for primary and secondary use.

Primary use refers to the processing of data in relation to a specific clinical trial protocol during its whole lifecycle, from the starting of the trial to deletion at the end of the archiving period, and  the basis for the processing of personal data is most often a legal obligation (e.g. reporting, archiving, disclosure, etc.) as well as a public interest in the area of public health.

In the secondary use of clinical trial data outside the clinical trial protocol for scientific purposes, it is possible to refer to compatibility of purposes and not to seek a new legal basis. Other options are consent, public or legitimate interest.

If consent under the GDPR needs to be collected, it is advisable to have it on a form separate from that of informed consent under the Clinical Trials Regulation in order to make it clear to the patient that it is two different documents that can be withdrawn by the patient at different times and with different consequences for the clinical trial activities.

In general, the data of patients in the clinical trial are “coded” (i.e. pseudonymised) as a measure of their protection. However, such data continues to be personal and the GDPR applies to them.

In some cases, patient data is anonymised (i.e. the patient cannot be identified at all) and therefore does not constitute personal data. The GDPR does not apply to the processing of such anonymous information, including for statistical or research purposes.

What are the roles and responsibilities of the parties involved?

Another issue for discussion, which in practice often gives rise to lengthy negotiations, is that of the roles of the parties involved in clinical trials within the meaning of the GDPR, namely whether they are controllers, processors or joint controllers. The definition of these roles is important regarding the responsibilities they have towards patients. In Bulgaria, the Commission for Personal Data Protection has accepted that the sponsor and the medical institution are joint controllers, i.e. jointly responsible for the lawful processing of patient data.

According to the guidance given by the EDPB, the sponsor and the investigator can be identified as joint controllers, or as controller and processor, as the case may be.

Practical guidelines on the protection of personal data in clinical trials

The GDPR imposes numerous obligations on controllers and processors that are valid for all data processing activities, including informing subjects, keeping records of processing activities, implementation of appropriate technical and organizational data security measures, incident reporting, etc. In the context of clinical trials, the relevant specificities must also be taken into consideration. For example, according to the Clinical Trials Regulation, the sponsor and the investigator shall archive the content of the clinical trial master file for a period of at least 25 years after the end of the clinical trial. This retention period must be complied with, including being recorded in the records of processing activities.

Given the special nature of the data processed in clinical trials (health information), the need to carry out and document a data protection impact assessment should also be considered.

Cross-border relations in clinical trials

A Sponsor in the US and a Researcher in Bulgaria – in which cases there is a personal data transfer? A researcher stores clinical trial data in a cloud maintained by a provider from Israel – is there a data transfer? In all cases, the transfer of personal data to countries outside the EU/ EEA qualifies as a transfer of data to third countries, which may take place only in compliance with certain additional requirements under the GDPR in order to ensure the necessary level of data protection.

In the context of a cross-border clinical trial relationship, it is important to identify all cases of transfer and the applicable data protection safeguards. In the absence of appropriate safeguards, the transfer could be based on the consent of the data subject (the patient), which would be separate from the consents discussed above.

New challenges: protecting personal data when using artificial intelligence and advanced technologies

Technology is an integral part of the activities of modern companies – a trend that we also observe in the field of clinical trials. For example, the new Clinical Trials Information System (CTIS) involves processing a huge amount of personal data of participants from all Member States which, given their sensitive nature, require enhanced security measures.

The use of artificial intelligence, which is becoming increasingly popular, could also be used in clinical trials – for example, in the selection of participants, the analysis of medical records and the generation of a list of suitable patients, the analysis of information on social networks and the identification of regions where a disease is prevalent, etc. However, the implementation of such technologies should always take into consideration specific risks in terms of personal data protection and rights of data subjects, for example in relation to the automated individual decision-making. Moreover, the estimation must not be subsequent but should precede the use of the technology and be based on an impact assessment.

In conclusion, compliance with the new regulations requires a comprehensive approach and expertise in various areas. In today’s world, data is a valuable asset and the challenges in their protection are many, but making efforts in this direction is at the same time a good opportunity for companies to optimize their activities.

This article is subject to copyright. It expresses the opinion of the authors and should not be considered as a recommendation to take certain actions or legal advice.

By Miglena Micheva, Managing Associate, Attorney-at-Law, and Irena Koleva Senior Associate, Attorney-at-Law, Deloitte Legal Law Firm

 

Djingov, Gouginski, Kyutchukov & Velichkov has advised ALC Clover Ireland Limited on the lease of a new aircraft to Fly Lease and its subsequent sublease to Bulgaria Air.

ALC Clover Ireland Limited is a subsidiary of the Air Lease Corporation. Founded in 2010, the Air Lease Corporation is an aircraft leasing company based in Los Angeles, California, engaged in purchasing commercial aircraft and leasing them to airline customers worldwide.

According to DGKV, “the deal is part of Bulgaria Air’s plans to expand its fleet with the most energy-efficient aircraft in the Airbus 220 family in June, August and September.”

The DGKV team included Partner Gergana Monovska, Senior Associate Deyan Bogdanov, and Associate Irina Mihaylova.

Eversheds Sutherland Bulgarian member firm Tsvetkova Bebov & Partners has advised the TBI Bank on the public placement of its EUR 10 million first tranche of senior non-preferred MREL bonds due 2026.

According to the firm, the tranche is part of a total of EUR 70 million in notes maturing June 2026, which contribute to the minimum requirement for eligible liabilities of TBI Bank EAD, as set by the Bulgarian National Bank. The notes have been admitted to trading on the Bulgarian Stock Exchange on July 4, 2023.

TBI Bank is a financial technology bank operating in Bulgaria, Romania, and Greece and is part of the 4Finance group.

Back in 2021, Tsvetkova Bebov & Partners advised TBI Bank on “the first-ever regulatory T2 bond issuance on the Bulgarian public capital markets” (as reported by CEE Legal Matters on December 22, 2021).

The Eversheds Sutherland team included Managing Partner Nikolay Bebov, Partner Damyan Leshev, Counsel Maria Karacholova, and Senior Associate Petar Ivanov.

Gugushev & Partners has advised Next Basket on an investment from the Innovation Capital Fund. Sole practitioner Sylvia Marushkina reportedly advised Innovation Capital.

Sofia-based Next Basket is developing a 360-degree e-commerce platform.

Innovation Capital is a Bulgarian venture capital fund and accelerator providing equity and quasi-equity funding to Bulgarian start-up companies.

The Gugushev & Partners team included Senior Partner Dimitrinka Metodieva and Partner Daniela Petkova.

Bulgaria’s outlook is improving, with its elected government working hard to catch up on crucial EU legal updates, while the country continues to attract investments in banking, energy, healthcare, and technology, according to Penkov Markov & Partners Associated Partner Boris Lazarov.

“The political situation in Bulgaria has been challenging, with the constant changes in government making it difficult to maintain a consistent legislative agenda,” Lazarov begins. “However, we now have a working government that is diligently catching up and prioritizing major changes to the energy act, an update to the commercial act, and of course FDI controls – if we don’t implement this now, we’ll be in trouble with the EU, so that’s crucial.”

“We’re also currently working with several NGOs to implement essential changes to Bulgaria’s commercial act,” Lazarov notes. “Among others, some financial instruments, such as option agreements like call, put, drag, and tag options or the role of escrow agents are not officially recognized in the Bulgarian legal system. It is crucial to update the law to acknowledge and regulate these instruments properly,” he explains.

Despite the political difficulties, Lazarov says “Bulgaria’s stable economic fundamentals have maintained its appeal to investors. Factors such as the geopolitical situation in the region, with issues in North Macedonia, Turkey, and the war in Ukraine, have led investors viewing Bulgaria as a comparatively safer investment destination.” Additionally, he reports that the Bulgarian National Bank’s “decision to set interest rates at 3%, lower than neighboring countries with rates between 5% and 6%, has made financing more affordable in Bulgaria, bolstering investor interest.”

“And ESG is also becoming increasingly important in business transactions, with clients showing a lot of interest in understanding and complying with ESG regulations,” Lazarov says. “As of now, there are draft bills addressing ESG-related matters, and we expect them to become a crucial part of due diligence in M&A transactions in the future,” he points out.

All the while, the banking sector in Bulgaria has seen a period of consolidation, according to Lazarov, “with the KBC Group acquiring the business of the Raiffeisen Group and Post Bank buying Bulgarian Branch office of PNB Paribas Personal Finance. This trend is likely to continue, with more transactions in the next three to five years, primarily small local banks being acquired by international players.”

And the energy sector is witnessing considerable interest from both local and foreign investors, particularly in renewable energy projects. Lazarov says they “recently advised the Global Biomet Group on their acquisition of a 100-megawatt project in Bankso, Bulgaria, and are advising another client on purchasing a 230-megawatt solar project.” Bulgaria’s compliance with the EU’s green deal and renewable energy regulations is making it “a prime destination for solar investments,” he explains.

In the healthcare sector, “we were involved in advising on the Fidelis deal in the biospecimen sector, which proved to be one of the best exits by a Bulgarian equity fund,” Lazarov highlights. “Though there have been fewer transactions in this sector so far this year, it remains an area with significant potential for future investment and development.”

Finally, Bulgaria’s tech sector has indeed seen remarkable growth, according to Lazarov, “with 40% of all transactions in 2022 occurring in this field. The success of notable acquisitions like VMware Bulgaria and the merger between the Chaos Group and Enscape has showcased Bulgaria’s potential as a tech hub.” Several factors contribute to this success, he explains, “including equity funds’ willingness to invest in startups, a skilled and talented developer workforce, and capable managers who can turn innovative ideas into world-class products.”

Schoenherr has advised Bulstrad Life Vienna Insurance Group Bulgaria on the acquisition of AmeriMed medical center. Reportedly, Stanev & Partners advised the sellers.

Bulstrad Life Vienna Insurance Group EAD is a Bulgarian life insurance company, part of Austria-based Vienna Insurance Group AG

AmeriMed medical center is a Bulgarian private medical center.

Tsvetkova Bebov & Partners (member of Eversheds Sutherland) has advised on Allianz Bank Bulgaria’s issue of senior preferred MREL bonds.

Allianz Bank Bulgaria is the eighth largest bank in Bulgaria with total assets of EUR 2 billion, with a market share of 2.4% as of year-end 2022.

According to Tsvetkova Bebov & Partners, “Allianz Bank Bulgaria, part of the global insurance and financial group Allianz, issued in late March 2023, in a private placement, EUR 39.5 million [in] senior preferred notes, maturing in March 2027. The notes contribute to the minimum requirement for eligible liabilities (MREL) of Allianz Bank Bulgaria, as set by Bulgarian National Bank. UniCredit Bulbank acted as the lead manager.”

According to the EBRD, “the project facilitates capital market development in Bulgaria, supports the resilience of ABB, and helps to deliver the EBRD’s green agenda in the country and national green economy priorities.”

Bulgaria’s Eversheds Sutherland member firm Tsvetkova Bebov & Partners’ team included Partners Damyan Leshev and Nikolay Bebov, Counsel Maria Karacholova, and Senior Associate Petar Ivanov.

Partners Stephan Kyutchukov and Zdravka Ugrinova have assumed joint management responsibilities as the Co-Managing Partners of Djingov, Gouginski, Kyutchukov & Velichkov.

Kyutchukov and Ugrinova have taken up leadership following the recent passing of former Managing Partner Assen Djingov.

According to DGKV, “Assen Djingov was one of the four founding partners of Djingov, Gouginski, Kyutchukov and Velichkov. Starting at the firm’s inception, for years he headed its M&A, General Corporate, and Banking & Finance practice groups. In his remarkable career, he advised clients, such as the EBRD, IFC, Entergy, AES, the Bulgarian American Enterprise Fund, CARESBAC, Nitro Nobel A.B., Conoco, OMV, Expandia Finance, and Hilton International. With the firm maturing and growing as a partnership, Assen stepped up as its first managing partner in the early 2000s. He laid the foundations of the firm’s management structure and steadily navigated the ship until his premature demise in May 2023.”

“Assen played a key role in founding DGKV and navigating our law firm to its top position in the Bulgarian legal market over the past 30 years,” commented Kyutchukov. “The cause and mission of DGKV were shaped by his leadership, dedication, and unwavering commitment to providing high-quality client service and building a strong team of talented lawyers. His legacy will always be cherished.”

“During this challenging time we are committed to maintaining continuity and ensuring a smooth and seamless transition in the firm’s management, for the benefit of our clients and team,” added Ugrinova. “We remain focused on maintaining the highest standards of legal services, integrity, and professionalism. We sincerely appreciate our clients’ continued trust and partnership.”

Boyanov & Co, working with Troutman Pepper, has advised the Deluxe Corporation on the sale of its Hostopia Bulgaria EOOD subsidiary to HostPapa.

HostPapa is a web hosting and cloud service provider for small and medium businesses. 

According to Boyanov & Co, “the transaction was part of a global acquisition by HostPapa of Deluxe Corporation’s web hosting and logo design businesses. The sale was successfully closed on June 29, 2023.”

The Boyanov & Co team included Partners Damian Simeonov and Borislav Notovsky.

Boyanov & Co did not respond to our inquiry on the matter.

Djingov Gouginski Kyutchukov & Velichkov has successfully represented the Miele Center Max Group before the Commission on Protection of Competition in antitrust proceedings initiated against Miele Bulgaria.

According to the firm, “the CPC upheld Miele Center Max Group’s claims that Miele Bulgaria had infringed the Bulgarian competition law by introducing a price-fixing mechanism by virtue of which it imposed and required retailers of Miele home appliance to apply retail prices determined by Miele Bulgaria.”

Djingov Gouginski Kyutchukov & Velichkov reported that “the CPC imposed a monetary sanction in the amount of BGN 1.61 million for an infringement of Article 15 of the Bulgarian Protection of the Competition Act and of Article 101 of the Treaty on the Functioning of the European Union. The penalty amounts to 10% of the turnover of the defendant for the preceding financial year, and this is the maximum amount that can be imposed for the violation of antitrust rules.” According to the firm, the decision can be appealed by Miele Bulgaria before Sofia’s Administrative Court.

The DGKV team was led by Partners Angel Ganev and Nikolai Gouginski and included Senior Associates Vladislav Antonov and Dessislava Iordanova and Associate Anna-Maria Atanasova.