Bulgaria’s passenger records, turned political¶

In July 2026 the Movement for Rights and Freedoms alerted Interpol, Europol and EU institutions to what it called an unprecedented misuse of Passenger Name Record data held by Bulgaria’s Passenger Information Unit: the records of more than 100,000 people, extracted and pushed into the public domain for political ends. The case shows a database built for one purpose, counter-terror and serious-crime screening, turned to another by the officials who held the keys.

What happened¶

Passenger Name Records are the booking and travel details that airlines pass to a national Passenger Information Unit under the EU PNR Directive, to be processed for defined law-enforcement purposes. In Bulgaria, the party alleged, data was extracted from that unit and disclosed with no connection to any criminal prosecution. It named those it held responsible: the interior minister Ivan Demerdzhiev, the acting head of the State Agency for National Security Stancho Stanchev, and the director of the organised-crime directorate Martin Zlatkov.

The trigger was a political feud. The disclosures grew out of checks into the private flights of the party’s leader, Delyan Peevski; on 2 July 2026 the interior minister reported 227 departures from Sofia airport since 2018, 181 of them by private aircraft. The party notified Interpol, Europol, EU institutions, affected countries’ embassies, national data-protection authorities and European civil-rights groups, arguing that three EU directives, the Charter of Fundamental Rights and the GDPR had been breached. The Digital Freedom Fund set out the accountability questions the case raises.

The control was the adversary¶

This is the insider version of the threat, seen from the inside. No adversary bypassed a control; the control was the adversary. A state database with lawful purposes and privileged access is only ever as safe as the incentives of the people who can query it, and in a political system under strain those incentives point the wrong way. The legal landscape can define a narrow purpose for PNR data, as the directive does, but purpose limitation on paper does not survive contact with an official who has both the access and a motive.

Last reviewed: 2026-07-08.