Two-and-a-half years after the launch of the Commercial Register, four of Bulgaria’s biggest business associations want the law changed to protect companies from identity theft, by limiting the currently free access to company records on the  register.

The call was made on June 1 at a business breakfast organised by the American Chamber of Commerce in Bulgaria in partnership with the Bulgarian Industrial Association, the Bulgarian Chamber of  Commerce and Industry and the Confederation of Employers and Industrialists in Bulgaria. The event was also co-organised by two of Parliament’s committees: on legal affairs and on economic policy, energy and tourism.

The private sector associations asked for the change because currently anyone with internet access can go to the register’s website at brra.bg, type in the name of any company and get information about its owners, their addresses, personal data such as date of birth and samples of executives’ handwritten signatures.  This is possible because the register posts PDFs of the handwritten forms filled in by companies’ owners.  

According to the four business organisations, free access to these personal data opens the way for corporate and personal identity theft and fraud.

The organisations have put forward draft amendments that would restrict public access to companies’ files by keeping public only the data required by law (for example, companies’ ownership and legal status) but without personal data being available. One way to do this could be using the service of lawyers or through the use of an e-signature.

Currently, there is an apparent clash between the Commercial Register Act and the Protection of Personal Data Act regarding free access to personal information.

But while some people see a contradiction between the two laws, others see no problem, given that access to the Commercial Register was designed to be free, as it is in other countries. On the other hand, recent years have seen a number of corporate ID thefts in Bulgaria, with foreign nationals often targeted. In such cases, however, the register’s job is to record court orders on changes of company ownership, which means that the responsibility lies more with the court than with the register.  

Against this background, the proposal by the four business associations got a mixed reaction. Some saw it as a way to restrict public access to personal data and introduce lawyers as intermediaries in the process, while others saw in it a threat to transparency. Indeed, any fee or administrative barrier would restrict public access to the register.
The media will be the first to be affected because information obtained from the register is often used in media reports and investigations. The same applies to NGOs and other civil organisations and citizens who simply want to know who owns their local grocery store, for example.

For now, it seems to be a case of finding the balance between public information and the currently vulnerable personal data which raises the question at the core of all of this: Why did the register decide to scan and upload the handwritten forms online in the first place?

Now, if the four business organisations manage to win the support of the ruling party to limit access to the content of the register, it will be a major technical feat to erase some of the data on the hundreds of thousands of PDFs. The issue is still in its early stages, with public discussions to be held in Parliament in the near future.