site.btaUPDATED Parliament Hears Competent Bodies about Recent Cases of Video Surveillance Misuse

The National Assembly held a hearing Thursday of Commission for Personal Data Protection (CPDP) Chair Borislav Bozhinov, Deputy Interior Minister Toni Todorov, and Chief Commissioner Vladimir Dimitrov, head of the Cybersecurity Department at the General Directorate for Combating Organized Crime, in connection with the recent cases of misuse of video surveillance cameras. The hearing was requested by Bozhidar Bozhanov of Continue the Change - Democratic Bulgaria.

Video footage from various offices, including gynaecology clinics and cosmetic studios, have been posted on the internet, which is an invasion of privacy, Bozhanov explained why the competent institutions need to be heard. Without interfering in where surveillance cameras should be placed, some institutions are nevertheless obliged to carry out prevention, while others are obliged to prosecute offenders, he stressed.

Therefore, the questions are whether the Commission for Personal Data Protection carries out risk assessments in individual sectors, whether sanctions have been imposed, whether there have been reports of such cases in the past, what preventive measures the Commission has taken or intends to take to ensure that no one gains unlawful access to these recordings, Bozhanov explained.

During the hearing, Dimitrov said that the Cybercrime Directorate of the General Directorate for Combating Organized Crime is investigating alerts submitted in connection with the recent cases of misuse of video surveillance cameras. He assured that the department is cooperating with various structures of the Interior Ministry and other institutions in order to protect the personal data of Bulgarian citizens. Unfortunately, in cyberspace, the possibilities for anonymity and compromise of various computer information systems by hackers are extremely wide, he said. According to him, there are video cameras in Bulgaria that are accessible for surveillance, and the materials from some of them are distributed illegally on pornographic websites.

"As a result of our actions, one of the websites with similar content in our country was shut down. As a result of the ongoing investigations, we are restricting other Internet resources where similar content is available," said the Chief Commissioner. If evidence of crimes is found, the materials gathered will be reported to the competent prosecution service, he assured.

MP Nikolay Radulov of Morality, Unity, Honour asked whether the GDCOC Cybersecurity Department was developing ideas and concepts for preventive action in view of the expansion of video surveillance networks. In Sofia, there are over 100,000 private cameras and over 120,000 municipal, state, and Road Infrastructure Agency cameras, the MP specified. Chief Commissioner Dimitrov explained that the Interior Ministry's Cybercrime Directorate is the main unit that combats cyber-related crimes. Through preventive campaigns, we are trying to inform the public about the main threats, he said. He noted that they had not considered creating a register of all cameras in Bulgaria. All alerts are being investigated, recorded, and distributed to employees, he added.

Deputy Interior Minister Todorov said that the CCTV cameras in beauty salons in Burgas (on the Black Sea) have been installed on the initiative of the owners of these establishments and are not used for security purposes within the meaning of the Private Security Activity Act by authorized employees of a security company on the basis of a contract between the parties. 

The Organized Crime Division in Burgas received an alert from the owner of a beauty salon in the city regarding leaked CCTV footage, which was forwarded to the Cybercrime Directorate at the General Directorate for Combating Organized Crime (GDCOC), said the Deputy Minister.

An alert has been submitted to the GDCOC department in Stara Zagora (South Central Bulgaria) by a 25-year-old Bulgarian citizen with a permanent address in Kazanlak, saying that she had found a video on the internet showing her cosmetic procedure at a beauty salon in the city, performed on September 16, 2023. A report has been prepared with a proposal to investigate the existence of evidence of crimes of a general nature under Article 159 of the Penal Code. The citizen has also filed a complaint with the District Prosecution Service in Stara Zagora, Todorov added. 

The GDCOC Cybercrime Directorate has also received an alert about a website streaming live footage from a kindergarten via CCTV cameras, Todorov told the MPs.

The Regional Directorate of the Interior in Burgas has initiated two pre-trial proceedings for the fact that, in the context of a continuing crime, an unknown person has created numerous pornographic materials through video recording and distributed them as computer data in a virtual environment through information and communication technology, namely the global computer network and mobile applications based on it, and that a person under the age of eighteen was used to create the pornographic material, the Deputy Minister said.

He also said that the Sofia Directorate of the Interior has initiated pre-trial proceedings for a crime under Article 159 of the Penal Code, and during joint operational and investigative activities with the Cybercrime Directorate officers, it was established that video footage of medical procedures was being distributed via a website.

The medical offices where the procedures were performed are located in various countries, including an address in Sofia. At the seven identified addresses of medical offices in Sofia, urgent procedural and investigative actions have been carried out, and in a medical office located at 74 Popova Shapka Street, a video camera has been found in a position corresponding to the available video content, Todorov said. The person whose mobile phone had the application installed to access the camera has been detained for 24 hours, added Todorov.

CPDP Chair Bozhinov said that the Commission had not received any alerts about video surveillance in beauty salons or gynecology clinics prior to the publicly announced cases. He noted that acting on its own initiative, the CPDP had begun inspections jointly with the Interior Ministry and regional health inspectorates in Sofia, Burgas, and other parts of the country. "If sufficient evidence is gathered regarding the guilt of a specific person, we will impose the most severe penalties possible, as what has been done is completely unacceptable," said the CPDP Chairman.  

Thus far, the CPDP has established that there are 14,000 studios and salons for laser hair removal registered in Bulgaria, Bozhinov said. With the resources available to the Commission, it is not possible to check them all in a timely manner, he underscored. He therefore called on citizens to report any cameras they find in premises where video surveillance should not be carried out.

In 2025 alone, 361 alerts were received about video surveillance, Bozhinov said. Over the years, there have been isolated cases of video surveillance cameras being installed in store changing rooms, public toilets, recreation rooms, changing rooms, or other specific locations, where on-site inspections were carried out, violations were found, and specific measures were prescribed and implemented, he said.

Bozhinov noted that there is currently no law that fully covers all possible scenarios relating to video surveillance. In this regard, the CPDP has set up a working group with the assistance of the Interior Ministry. Bozhinov expressing the hope that by mid-2026, there will be a vision of how the matter should be regulated.

Bozhinov called for higher salaries and additional experts at the CPDP, because the recent years have seen an upward trend in the number of alerts and complaints submitted to the Commission. Preliminary data for 2025 show an increase of at least 30%. 

Asked by MP Snezhana Trayanska of There Is Such a People whether the CPDP has enough staff to perform its functions, Bozhinov said that the staffing and administrative capacity is not sufficient to cope. More staff need to be hired, and the salaries of a significant number of them need to be increased, he argued. "I dare say that the pay at the expert level does not correspond to the workload and expectations placed on us," he added.

Bozhanov asked the CPDP Chair why there were no guidelines on video surveillance published on its website. Bozhinov replied that guidelines have been published at least three times in recent years, as well as opinions on the processing of video footage. He explained that the Commission also issues numerous opinions aimed at administrators to assist in the administration of personal data. When it comes to prevention, 770 proceedings on the merits have been completed since May 2025 under the current composition of the Commission, and its working capacity has almost doubled. According to Bozhanov, the CPDP has a stable position as a regulator and fulfills its role in protecting personal data. Proof of this is that a large part of the Commission's decisions - 90% - were confirmed and entered into force, which is a high success rate.