ANSPDCP (Romania) - 25.09.2023
| ANSPDCP - 25.09.2023 | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 13 GDPR Article 14 GDPR Article 32 GDPR 14 (5) (e) Law 190/2018 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 2000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 25.09.2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Romanian |
| Original Source: | Romanian DPA (in RO) |
| Initial Contributor: | Silvia Axinescu |
The City Hall of Albeni was sanctioned with a fine of 10,000 lei (equivalent to EUR 2000) for the failure to comply with the remediation measures ordered by the Romanian DPA following a remediation plan, as well as for failure to respond to the DPA’s requests. Additionally, the controller was fined with a warning for the failure to inform the data subjects of their rights under GDPR, as well as for the failure to adopt adequate technical and organizational measures for the protection of personal data through the CCTV system implemented by the City Hall.
English Summary
Facts
The City Hall of Albeni (Gorj county, Romania) implemented a CCTV system through which all employees of the City Hall were monitored and screened by the City Hall Mayor. The Romanian DPA opened an investigation following a complaint regarding a possible breach of applicable legislation with respect to the processing of personal data through the CCTV system.
Holding
During the investigation, which was finalized in July 2023, it was found that the controller failed to comply with previous measures imposed by the DPA through the remediation plan and that the City Hall did not reply to the requests of the DPA. Note should be made that in accordance with the provisions of Law 190/2013, in case of breaches of GDPR at the level of public authorities (such as the case of the City Hall), the Romanian DPA shall firstly issue a record of findings and penalties with respect to the breach, as well as a warning, together with a remediation plan (entailing correspondent measures and a deadline for remediation). Following the expiry of the remediation term, the Romanian DPA may resume the investigation to verify the fulfillment of the remediation measures imposed. Also, it was found that the controller failed to make proof that the data subjects were correspondently informed of their rights under GDPR and failed to adopt appropriate technical and organizational measures in order to ensure protection of personal data processed through the CCTV video system implemented by the City Hall, assessing thus a breach of Articles 13 and 14 GDPR and, respectively of Article 32 GDPR. The Romanian DPA also imposed corrective measures, ordering the City Hall of Albeni to the followings: - To comply with all of the requests of the Romanian DPA, as ordered through the remediation plan - To implement appropriate technical and organizational measures with respect to the protection of personal data processed through the video surveillance system of the City Hall of Albeni - To transmit to the Romanian DPA, in copy, the procedure/procedures adopted and the evidence of the training carried out for the persons having access to the images taken through the video surveillance system, as well as to take the necessary measures so that the data subjects are informed of their rights under GDPR in accordance with the provisions of Articles 13 and 14 of the GDPR.
Comment
Unfortunately, the Romanian DPA does not publish its full decisions. This summary is based on a press release.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
https://www.dataprotection.ro/?page=Comunicat_Presa_25.09.2023&lang=ro
