ANSPDCP (Romania) - Fine against IAMSAT Muntenia SA

ANSPDCP (Romania) - Fine against IAMSAT Muntenia SA
Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 12 GDPR Article 12(3) GDPR Article 13 GDPR Article 21 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	22.02.2022
Fine:	3000 EUR
Parties:	IAMSAT Muntenia SA
National Case Number/Name:	Fine against IAMSAT Muntenia SA
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	Diana Rosu

A controller was fined EUR1000 for not answering an objection request and EUR2000 for not informing its employees about the video surveillance systems installed at the workplace.

English Summary

Facts

A data subject, ex-employee of a controller, made an object request, asking the controller to stop processing their personal data considering they did not have anymore an ongoing contractual relationship. The controller did not solve nor reply to the data subject's request before the legal deadline, in breach of GDPR Article 12(3) and 21. As such, the data subject filed a complaint with the Romanian DPA.

During the investigation, besides the facts concerning the data subject's right request, the authority found that the controller was conducting video surveillance at its workplace and therefore processing personal data, without priorly informing the employees (data subjects).

Holding

The controller was found in breach of: - GDPR Articles 12(3) and 21 for not handling the data subject right request and fined approximately EUR1000 (RON 4.946,2); - GDPR Articles 12-13 for not informing data subjects on the processing of personal data through video surveillance at the workplace.

Additionally, the controller was requested to comply with the following corrective measures: - to inform the data subjects and particularly its employees on the data processing activities conducted through video surveillance; - to reply to the data subject and to solve their request accordingly.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

22.02.2022

Sanction for violating the RGPD



In February 2022, the National Supervisory Authority completed an investigation at the IAMSAT Muntenia SA operator and found a violation of the provisions of art. 12, art. 13 and art. 21 of the General Data Protection Regulation.

The operator was sanctioned for minor offenses, as follows:

fine in the amount of 9,892.4 lei, the equivalent of 2,000 euros for violating the provisions of art. 12-13 of the General Regulation on Data Protection; fine in the amount of 4,946.2 lei, the equivalent of 1,000 euros for violating the provisions of 12 para. (3) and art. 21 of the General Data Protection Regulation.

The investigation was initiated following a complaint lodged by a data subject who complained that IAMSAT Muntenia SA continued to process his personal data after the termination of his employment contract in 2020. By a request, this person informed the operator that he / she does not consent to the use of his / her e-mail address and that he / she opposes the processing of his / her personal data by IAMSAT Muntenia SA and / or third parties, natural or legal, after the termination of the employment contract.

During the investigation, it was noted that IAMSAT Muntenia SA did not present evidence regarding the prior and complete information of its employees, including the data subject, before starting the processing of personal data of these persons by means of video surveillance installed in their place. of work, put into operation from the middle of 2020, although the operator had the obligation to inform the employees according to art. 12-13 of the General Regulation on Data Protection.

At the same time, it was noted that IAMSAT Muntenia SA did not resolve the request of the data subject and did not communicate a response regarding the measures adopted following the exercise of the right of opposition within the legal deadlines, in accordance with the provisions of art. 12 para. (3), reported to art. 21 of the General Data Protection Regulation.

At the same time, two corrective measures were applied to the operator's investigation, as follows:

corrective action to ensure compliance with the General Data Protection Regulation of personal data processing operations, by providing full information to data subjects, in particular employees of the controller, on the use of the video surveillance system, in relation to the obligations of art. 12-13 of the General Regulation on Data Protection; the corrective measure to send a response to the person concerned to his request, including the measures adopted following the exercise of the right of opposition, by reference to the provisions of art. 12 and 21 of the General Data Protection Regulation.



Legal and Communication Department

A.N.S.P.D.C.P.