ANSPDCP (Romania) - 25.09.2023: Difference between revisions

Revision as of 07:47, 3 October 2023

ANSPDCP - 25.09.2023

Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 13 GDPR Article 14 GDPR Article 32 GDPR 14 (5) (e) Law 190/2018
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:
Fine:	2000 EUR
Parties:	n/a
National Case Number/Name:	25.09.2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	Romanian DPA (in RO)
Initial Contributor:	Silvia Axinescu

The City Hall of Albeni was sanctioned with a fine of 10,000 RON (equivalent to €2000) for the failure to comply with the remediation measures ordered by the Romanian DPA following a remediation plan, as well as for the failure to inform data subjects of their rights under GDPR, and for failing to adopt adequate technical and organisational measures in relation to the CCTV system implemented by the City Hall.

English Summary

Facts

The City Hall of Albeni (Gorj county, Romania) implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint concerning the CCTV system.

Holding

During the investigation, which was finalized in July 2023, it was found that the controller failed to comply with previous measures imposed by the DPA through the remediation plan and that the City Hall did not reply to the requests of the DPA. Note should be made that in accordance with the provisions of Law 190/2013, in case of breaches of GDPR at the level of public authorities (such as the case of the City Hall), the Romanian DPA shall firstly issue a record of findings and penalties with respect to the breach, as well as a warning, together with a remediation plan (entailing correspondent measures and a deadline for remediation). Following the expiry of the remediation term, the Romanian DPA may resume the investigation to verify the fulfillment of the remediation measures imposed. Also, it was found that the controller failed to make proof that the data subjects were correspondently informed of their rights under GDPR and failed to adopt appropriate technical and organizational measures in order to ensure protection of personal data processed through the CCTV video system implemented by the City Hall, assessing thus a breach of Articles 13 and 14 GDPR and, respectively of Article 32 GDPR. The Romanian DPA also imposed corrective measures, ordering the City Hall of Albeni to the followings: - To comply with all of the requests of the Romanian DPA, as ordered through the remediation plan - To implement appropriate technical and organizational measures with respect to the protection of personal data processed through the video surveillance system of the City Hall of Albeni - To transmit to the Romanian DPA, in copy, the procedure/procedures adopted and the evidence of the training carried out for the persons having access to the images taken through the video surveillance system, as well as to take the necessary measures so that the data subjects are informed of their rights under GDPR in accordance with the provisions of Articles 13 and 14 of the GDPR.

Comment

Unfortunately, the Romanian DPA does not publish its full decisions. This summary is based on a press release.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

https://www.dataprotection.ro/?page=Comunicat_Presa_25.09.2023&lang=ro

@@ Line 65: / Line 65: @@
 }}
-The City Hall of Albeni was sanctioned with a fine of 10,000 lei (equivalent to EUR 2000) for the failure to comply with the remediation measures ordered by the Romanian DPA following a remediation plan, as well as for failure to respond to the DPA’s requests. Additionally, the controller was fined with a warning for the failure to inform the data subjects of their rights under GDPR, as well as for the failure to adopt adequate technical and organizational measures for the protection of personal data through the CCTV system implemented by the City Hall.
+The City Hall of Albeni was sanctioned with a fine of 10,000 RON (equivalent to €2000) for the failure to comply with the remediation measures ordered by the Romanian DPA following a remediation plan, as well as for the failure to inform data subjects of their rights under GDPR, and for failing to adopt adequate technical and organisational measures in relation to the CCTV system implemented by the City Hall.
 == English Summary ==
 === Facts ===
-The City Hall of Albeni (Gorj county, Romania) implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint regarding a possible breach of applicable legislation with respect to the processing of personal data through the CCTV system.
+The City Hall of Albeni (Gorj county, Romania) implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint concerning the CCTV system.
 === Holding ===