ANSPDCP (Romania) - Warning issued to Cluj-Napoca Municipality

ANSPDCP - Warning issued to Cluj-Napoca Municipality

Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR Articles 12-14 Law no. 190/2018
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	11.12.2020
Published:	22.12.2020
Fine:	None
Parties:	n/a
National Case Number/Name:	Warning issued to Cluj-Napoca Municipality
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	Stefan Musat

The Romanian DPA issued a warning to the Cluj-Napoca Municipality, for the General Directorate of Local Police, for breaching the provisions of Article 5(1)(a)GDPR reported to Article 6(1) GDPR. The warning was issued along with a corrective measure.

English Summary

Facts

The Romanian DPA (ANSPDCP) received a complaint regarding the violation of the GDPR by the General Directorate of Local Police Cluj-Napoca regrading the personal data processing using the "Body-Worn Camera" (which processes image and voice).

Dispute

Does the controller processed the personal data using the "Body-Worn Camera" (which processes image and voice) according to Article 5(1)(a) GDPR and Article 6(1) GDPR?

Holding

The ANSPDCP found that the staff of the General Directorate of Local Police Cluj-Napoca processed personal data without a legal basis by using the portable audio-video system type "Body-Worn Camera". The controller did not have a legal obligation for the processing and did not fulfilled any other requirement of Article 6(1) GDPR.

The General Directorate of Local Police Cluj-Napoca started the non-compliant processing on October 2019 when the "Body-Worn Camera" recording system was used by local police officers in the exercise of their duties to record the following categories of interventions and actions: a) establishing the identity of persons; b) driving people to the local police headquarters; c) using force and weapons; d) performing body or luggage search; e) stopping vehicles; f) finding flagrant offenses and misdemeanors; g) preventing of an imminent danger to the life, health and physical integrity of a person.

The Romanian DPA issued the warning because the controller processed the personal data (image, voice) without fulfilling the legality conditions provided in Article 6(1) GDPR. In addition, the ANSPDCP applied a corrective measure through a remediation plan according to which the controller must ensure the compliance of the processing operations, performed by using the portable audio-video systems of the “Body-Worn Camera” type, with the provisions of Article 5 and Article 6 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

The National Supervisory Authority completed on 11.12.2020 an investigation in the Municipality of Cluj-Napoca, represented by the Mayor, for the General Directorate of Local Police Cluj-Napoca and found the violation of the provisions of art. 5 para. (1) lit. a) reported to art. 6 para. (1) of the General Data Protection Regulation.
The municipality of Cluj-Napoca, for the General Directorate of Local Police Cluj-Napoca was sanctioned with a warning, pursuant to art. 58 para. (2) lit. b) of Regulation (EU) 2016/679, reported to art. 14 para. (11) and art. 15 para. (1) of Law no. 102/2005, as well as pursuant to art. 12-14 of Law no. 190/2018, corroborated with art. 7 of GO no. 2/2001, as the staff of the General Directorate of Local Police Cluj-Napoca, in the exercise of specific missions and activities, processed personal data using the portable audio-video system type "Body-Worn Camera"; (which processes the image and voice ), starting with October 2019, without there being a legal obligation of the operator and without fulfilling any other condition provided in art. 6 para. (1) of the RGPD, although according to art. 5 para. (1) lit. a) of the RGPD, the operator had the obligation to process the data legally, fairly and transparently to the data subject.

The sanction of the warning was accompanied by the application of a corrective measure, through the remediation plan, according to the provisions of art. 12-14 of Law no. 190/2018 on measures for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing of Directive 95/46 / EC (General Data Protection Regulation). Thus, the operator was ordered to ensure the compliance of the processing operations, performed by using portable audio-video systems of the type "Body-Worn Camera", with the provisions of art. 5 and art. 6 of the RGPD.

The investigation was carried out following the receipt of a notification regarding the violation of the legislation on personal data protection by the General Directorate of Local Police Cluj-Napoca.

It was found that the General Directorate of Local Police Cluj-Napoca processes personal data through portable audio-video systems such as "Body-Worn Camera", used by local police officers in the exercise of duties to record the following categories of interventions and actions:
a) legitimation of persons;
b) driving people to the local police headquarters;
c) the use of force and means;
d) performing the body control or the luggage;
e) stopping vehicles;
f) finding flagrant offenses and contraventions;
g) those determined by the prevention of an imminent danger to the life, health and physical integrity of a person.

The General Directorate of Local Police Cluj-Napoca could not prove compliance with art. 6 para. (1) of the RGPD regarding the legality of the processing performed through the portable audio-video system of the “Body-Worn Camera” type. Consequently, it was found that the processing of personal data (image, voice) was carried out without fulfilling the legality conditions provided in art. 6 para. (1) of the RGPD.

Legal and Communication Department
ANSPDCP