ANSPDCP (Romania) - 25.09.2023: Difference between revisions

Latest revision as of 06:40, 4 October 2023

ANSPDCP - 25.09.2023

Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 13 GDPR Article 14 GDPR Article 32 GDPR 14 (5) (e) Law 190/2018
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:
Fine:	2000 EUR
Parties:	n/a
National Case Number/Name:	25.09.2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	Romanian DPA (in RO)
Initial Contributor:	Silvia Axinescu

The City Hall of Albeni was fined 10,000 RON (equivalent to €2000) for failing to comply with remediation measures ordered by the Romanian DPA following a remediation plan, as well as for failing to inform data subjects of their rights under GDPR, and for failing to adopt adequate technical and organisational measures in relation to the CCTV system implemented by the City Hall. The DPA found a violation of Articles 13, 14 and 32 GDPR.

English Summary

Facts

The controller, the City Hall of Albeni (Gorj county, Romania) had implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint concerning the CCTV system.

During the investigation, it was found that the controller had failed to comply with previous measures imposed by the DPA during the course of its investigation. As a result, the DPA found violations of Articles 13, 14 and 32 GDPR.

In accordance with the provisions of Law 190/2013, in response to GDPR breaches committed by public authorities (such as the case of the City Hall), the Romanian DPA must first issue a record of findings and penalties with respect to the breach, as well as a warning, and submit a remediation plan (entailing correspondent measures and a deadline for remediation). Following the expiry of the remediation term, the Romanian DPA may resume the investigation to verify the fulfillment of the remediation measures imposed. In the current case, the Romanian DPA had submitted a remediation plan to the controller during the course of their investigation.

Holding

Following the expiry of the remediation term, it was found that the controller had failed to demonstrate that they had informed their employees (the data subjects) of their rights under the GDPR and failed to adopt the appropriate technical and organisational measures to ensure secure processing through the CCTV video system. Consequently, the DPA found a breach of Articles 13 and 14 GDPR, and of Article 32 GDPR, and as a result, fined the controller 10,000 RON (equivalent to €2000).

The Romanian DPA imposed corrective measures, ordering the followings:

To comply with all of the requests of the Romanian DPA, as ordered through the remediation plan;
To implement appropriate technical and organisational measures with respect to the protection of personal data processed through the video surveillance system of the City Hall of Albeni;
To inform the Romanian DPA of the procedures adopted in relation to the employees who had access to CCTV system;
To take the necessary measures to inform data subjects of their rights under the GDPR in accordance with Articles 13 and 14 GDPR.

Comment

Unfortunately, the Romanian DPA does not publish its full decisions. This summary is based on a press release.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

https://www.dataprotection.ro/?page=Comunicat_Presa_25.09.2023&lang=ro

@@ Line 65: / Line 65: @@
 }}
-The City Hall of Albeni was sanctioned with a fine of 10,000 lei (equivalent to EUR 2000) for the failure to comply with the remediation measures ordered by the Romanian DPA following a remediation plan, as well as for failure to respond to the DPA’s requests. Additionally, the controller was fined with a warning for the failure to inform the data subjects of their rights under GDPR, as well as for the failure to adopt adequate technical and organizational measures for the protection of personal data through the CCTV system implemented by the City Hall.
+The City Hall of Albeni was fined 10,000 RON (equivalent to €2000) for failing to comply with remediation measures ordered by the Romanian DPA following a remediation plan, as well as for failing to inform data subjects of their rights under GDPR, and for failing to adopt adequate technical and organisational measures in relation to the CCTV system implemented by the City Hall. The DPA found a violation of [[Article 13 GDPR|Articles 13]], [[Article 14 GDPR|14]] and [[Article 32 GDPR|32 GDPR]].
 == English Summary ==
 === Facts ===
-The City Hall of Albeni (Gorj county, Romania) implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint regarding a possible breach of applicable legislation with respect to the processing of personal data through the CCTV system.
+The controller, the City Hall of Albeni (Gorj county, Romania) had implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint concerning the CCTV system.
+During the investigation, it was found that the controller had failed to comply with previous measures imposed by the DPA during the course of its investigation. As a result, the DPA found violations of Articles 13, 14 and 32 GDPR.
+In accordance with the provisions of Law 190/2013, in response to GDPR breaches committed by public authorities (such as the case of the City Hall), the Romanian DPA must first issue a record of findings and penalties with respect to the breach, as well as a warning, and submit a remediation plan (entailing correspondent measures and a deadline for remediation). Following the expiry of the remediation term, the Romanian DPA may resume the investigation to verify the fulfillment of the remediation measures imposed. In the current case, the Romanian DPA had submitted a remediation plan to the controller during the course of their investigation.
 === Holding ===
-During the investigation, which was finalized in July 2023, it was found that the controller failed to comply with previous measures imposed by the DPA through the remediation plan and that the City Hall did not reply to the requests of the DPA.
+Following the expiry of the remediation term, it was found that the controller had failed to demonstrate that they had informed their employees (the data subjects) of their rights under the GDPR and failed to adopt the appropriate technical and organisational measures to ensure secure processing through the CCTV video system. Consequently, the DPA found a breach of [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14&nbsp;GDPR]], and of [[Article 32 GDPR]], and as a result, fined the controller 10,000 RON (equivalent to €2000).
-Note should be made that in accordance with the provisions of Law 190/2013, in case of breaches of GDPR at the level of public authorities (such as the case of the City Hall), the Romanian DPA shall firstly issue a record of findings and penalties with respect to the breach, as well as a warning, together with a remediation plan (entailing correspondent measures and a deadline for remediation). Following the expiry of the remediation term, the Romanian DPA may resume the investigation to verify the fulfillment of the remediation measures imposed.
-Also, it was found that the controller failed to make proof that the data subjects were correspondently informed of their rights under GDPR and failed to adopt appropriate technical and organizational measures in order to ensure protection of personal data processed through the CCTV video system implemented by the City Hall, assessing thus a breach of Articles 13 and 14 GDPR and, respectively of [[Article 32 GDPR|Article 32 GDPR]].
+The Romanian DPA imposed corrective measures, ordering the followings:
-The Romanian DPA also imposed corrective measures, ordering the City Hall of Albeni to the followings:
--	To comply with all of the requests of the Romanian DPA, as ordered through the remediation plan
+* To comply with all of the requests of the Romanian DPA, as ordered through the remediation plan;
--	To implement appropriate technical and organizational measures with respect to the protection of personal data processed through the video surveillance system of the City Hall of Albeni
+* To implement appropriate technical and organisational measures with respect to the protection of personal data processed through the video surveillance system of the City Hall of Albeni;
--	To transmit to the Romanian DPA, in copy, the procedure/procedures adopted and the evidence of the training carried out for the persons having access to the images taken through the video surveillance system, as well as to take the necessary measures so that the data subjects are informed of their rights under GDPR in accordance with the provisions of Articles 13 and 14 of the GDPR.
+* To inform the Romanian DPA of the procedures adopted in relation to the employees who had access to CCTV system;
+* To take the necessary measures to inform data subjects of their rights under the GDPR in accordance with [[Article 13 GDPR|Articles 13]] and [[Article 14 GDPR|14&nbsp;GDPR.]]
 == Comment ==