The Data Retention Directive 2006/24/EC was initially transposed into the Bulgarian legal order in 2008 through a regulation enacted by the Minister of Interior and the President of the State Agency of Information Technologies and Communications. The regulation introduced a 12-month long retention period for electronic communication and allowed a unit in the Ministry of Interior direct access to the data. In December 2008, the Supreme Administrative Court held that the regulation violated Articles 32 and 34 of the Bulgarian Constitution and Article 8 of the European Convention on Human Rights. The later amendments to the data protection legislation were found in contravention of the Constitution by the Constitutional Court in 2015. The Parliament passed new provisions in line with the Constitutional Court judgment shortening the retention period to six months. Subsequently, in 2016 and 2018, the new laws on anti-terrorism and anti-corruption tend to shift the balance back to security, rather than privacy.