Summary

  • Bulgaria's regulator says three public authorities have DSA roles: the Communications Regulation Commission (CRC), the Council for Electronic Media (CEM) and the Commission for Personal Data Protection (CPDP).
  • In an additional formal notice on 1 October, the European Commission said Bulgaria still had not properly designated and empowered CEM and CPDP, and separately challenged the country's implementation of DSA penalties.

The State Gazette published Bulgaria’s three-agency coordination instruction on 24 September. Seven days later, the European Commission said two of those agencies still lacked proper designation and powers under the DSA. The calendar sharpens the dispute: Sofia has a routing rule; Brussels says the legal authority behind two routes remains insufficient.

On 1 October 2026, the European Commission sent Bulgaria an additional letter of formal notice in infringement file INFR(2024)2241. The Commission said Bulgaria had legislated to empower one authority acting as Digital Services Coordinator, but it still considered the Council for Electronic Media and the Commission for Personal Data Protection insufficiently designated and empowered to complete the national enforcement framework. The letter follows a reasoned opinion issued in May 2025.

Amendments to the Electronic Communications Act made the CRC Bulgaria’s Digital Services Coordinator. Its own responsibilities page lists the CEM and CPDP alongside the CRC and sketches a division among video-sharing oversight, intermediary services and personal-data duties.

The Commission raises a second charge against Bulgaria’s penalty rules. It says national law does not always respect the DSA’s fine ceilings or ensure every penalty is effective, proportionate and dissuasive; it also objects to different treatment of natural and legal persons. Its public notice does not identify the Bulgarian provisions behind that claim.

Instruction No. 3 was issued on 30 July and published in the State Gazette on 24 September 2026—seven days before the Commission's notice. Its Article 4 calls CRC the national coordinator and main supervisory and enforcement body. Article 5 expressly identifies CEM as a competent authority under DSA Article 49(1), with video-sharing-platform oversight except for Articles 25 and 27. Article 6 also identifies CPDP as a competent authority under Article 49(1), but limits its DSA role to data-protection rights for processing under Articles 26(3) and 28 in line with the GDPR; outside those cases, it acts under data-protection law.

Articles 8–10 set notification, information-exchange and joint-inspection procedures. The Gazette therefore gives both disputed bodies a formal competent-authority label while defining narrow remits. In practical terms, CEM’s exceptions cover the DSA rules against manipulative interface design (Article 25) and on explaining recommender systems (Article 27). CPDP’s two hooks concern ads using special-category personal data (Article 26(3)) and protections for minors (Article 28). The Commission's notice came a week later and says they remain undesignated and underpowered.

That distinction matters to platforms and people using them. A coordinator can route a complaint or connect national authorities to the Commission. A sector regulator may supervise one class of service. A data-protection authority may act on a defined slice of DSA obligations. Those jobs can fit together, but the legal hand-offs need an accountable owner. If a duty falls between the map and the statute, a coordination meeting cannot supply the missing power.

Instruction No. 3 organizes complaint routing and sets clocks for inter-agency notice and joint inspections. That tells a platform how a complaint moves, not which authority can make a binding decision on each DSA duty. The dispute is whether CEM’s video-platform remit and CPDP’s two data-protection assignments carry the designation and enforcement powers the DSA requires. Bulgaria’s answer will have to connect each obligation to an authority, an investigative power and a sanction that fits the regulation.

Sources