ANSPDCP (Romania) - Fine against Glove Technology SRL

ANSPDCP (Romania) - Fine against Glove Technology SRL
Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 5(1)(a) GDPR Article 6(1) GDPR Article 58(1)(a) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	23.09.2021
Published:	21.10.2021
Fine:	24745 RON
Parties:	Glove Technology SRL
National Case Number/Name:	Fine against Glove Technology SRL
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	Diana Rosu

The Romanian DPA fined a controller approximately €5,000 (RON 24,745) after it used CCTV systems to surveil its employees, record their conversations and use the recordings against them, in breach of Article 5(1) and 6(1) of the GDPR.

English Summary

Facts

After a data subject filed a complaint, the Romanian DPA started an investigation against the controller Glove Technology SRL. The investigation revealed that the controller used CCTV cameras inside its offices to surveil its employees and record their conversations with the intention to use the recorded files against them.

Holding

The Romanian DPA found that the surveillance took place without a legal base as required by the GDPR's Article 6(1) and breached the lawfulness, fairness and transparency principle [GDPR's Article 5(1)]. As result, the controller was fined approximately €5,000 (RON 24,745) and, based on GDPR's Article 58(2), the DPA required the controller to ensure its privacy compliance for future CCTV surveillance, stop any data processing that was made through uncompliant CCTV systems and delete any subsequent data that might have been collected unlawfully through the CCTV systems.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

21.10.2021 & # 13;
Sanction for violating RGPD & # 13;
& # 13;
The National Supervisory Authority completed, on 23.09.2021, an investigation at the operator Glove Technology SRL, following which it was found the violation of the provisions of art. 5 para. (1) lit. a) reported to art. 6 para. (1) of the General Regulation on Data Protection, the operator being sanctioned with a fine in the amount of 24,745.00 lei (equivalent to 5,000 EURO). & # 13;
The sanction was granted because it was found that the operator processed personal data of its employees by using an audio-video system (image and voice), without proving compliance with the legal grounds provided by art. 6 para. (1) of the RGPD, respectively obtaining the consent of the data subjects, fulfilling a legal obligation or the prevalence of its legitimate interest over the interests, rights and freedoms of the data subjects. & # 13;
It was also found that the operator took the measure of monitoring employees at work through audio-video surveillance systems without complying with the first principle established by art. 5 para. (1) lit. a) of the RGPD, according to which the operator has the obligation to process the data legally, equitably and transparently towards the data subject. & # 13;
At the same time, pursuant to art. 58 para. (2) lit. d) of the RGPD, the corrective measure was ordered against the operator to ensure the conformity of the processing operations performed using audio-video systems, as well as the cessation of any operation or set of personal data processing operations performed via audio-video systems. video and deletion of the personal data record system established as a result of the use of such systems. & # 13;
The investigation was started as a result of a notification, which indicated that the operator Glove Technology SRL has installed some audio-video surveillance cameras inside the offices, for direct surveillance of employees at work where they work and record discussions between they, for the purpose of their subsequent use against those employees. & # 13;
In this context, we emphasize that, insofar as an employer uses monitoring systems by means of video surveillance at work, the processing of personal data of employees in order to achieve the legitimate interests of the employer (art. 6 para. 1 letter f) of the RGPD) is carried out in compliance with the provisions of art. 5 of Law no. 190/2018 which establish, as a first condition, that the legitimate interests pursued by the employer are duly justified and prevail over the interests or rights and freedoms of the persons concerned. & # 13;
& # 13;
Legal and Communication Department & # 13;
A.N.S.P.D.C.P.