Pursuant to the assignment of receivables agreement the creditor under a certain receivable assigns it to a third party. As the assignment procedure involves the processing of personal data of a third party – a debtor that is not a party to the agreement, a thorough examination of the personal data protection rules and their applicability to the assignment of receivables is required.
Pursuant to the assignment of receivables (cession) agreement the creditor under a certain receivable (assignor) assigns it to a third party (assignee). As the assignment procedure involves processing of personal data of a third party – a debtor that is not a party to the agreement, thorough examination of the personal data protection rules and their applicability to the assignment of receivables is required. The present analysis examines a situation where the debtor is a natural person. The conclusions outlined below can be applied by analogy to assignments where the debtors are legal entities, taking into account the specifics of the relationship between legal entities (i.e. exchange of information about their legal representatives, proxies, etc.).
Is the debtor’s consent required for the purposes of assigning their receivables?
The consent under an assignment agreement may be approached from two perspectives:
What is the basis for the personal data processing under the assignment agreement?
Other legal grounds, equal and alternative to the consent, may serve as basis for processing the debtor’s personal data, namely:
According to the Commission for Personal Data Protection (CPDP), the legal fact which makes the personal data processing admissible is the assignment of the receivable, not the notification of the debtor. This means that the assignee may lawfully process the debtor’s personal data even prior to this notification.
Other requirements for the personal data protection in the case of assignment of receivables
An essential requirement to be fulfilled in case of an assignment is the notification of the debtor of the processing of their personal data, since the data controller – assignee obtains the personal data not directly from the data subject, but from another source – the assignor. In order to ensure transparent data processing, the data subject needs to be provided with information under Art. 14 of the GDPR, namely:
The GDPR requires the controller to provide this information as follows:
In practice, there are numerous cases where assignees have been sanctioned specifically for non-compliance with the above requirement to inform the data subject. The GDPR, as a rule, allows exceptions to the above obligation to provide information if the receipt or disclosure of data is expressly permitted by EU law or the laws of a Member State, which provides for appropriate measures to protect the legitimate interests of the data subject. It is unclear how CPDP will interpret this rule in the context of the assignment agreement (under which the disclosure and receipt of data is explicitly regulated by the Bulgarian legislation). Given the above practice of imposing sanctions, a safer approach for assignees would be to expressly notify the data subjects.
It is permitted to inform the data subject of the processing in parallel with notifying the debtor of the assignment by the assignee. This is explicitly recognized in the case law.
Is it possible that the expired limitation period of the assigned receivable affects the lawfulness of the personal data processing?
Whether the prescribed limitation period for the receivable has expired or not, whether the debtor’s objection to the expired limitation period has been duly exercised, etc., are all issues within the jurisdiction of the civil court and do not affect the lawfulness of the personal data processing.
You may read an article on the topic by Martin Zahariev here: https://www.tita.bg/free/commercial-law/660
