ANSPDCP (Romania) - Compania de Transport Public Cluj-Napoca S.A.
ANSPDCP - Compania de Transport Public Cluj-Napoca S.A. | |
---|---|
Authority: | ANSPDCP (Romania) |
Jurisdiction: | Romania |
Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 5(1)(c) GDPR Article 5(2) GDPR Article 6 GDPR Article 5(a) to (d) Law no. 190/2018 |
Type: | Complaint |
Outcome: | Upheld |
Started: | |
Decided: | 12.12.2024 |
Published: | |
Fine: | 19,902 RON |
Parties: | Compania de Transport Public Cluj-Napoca S.A. |
National Case Number/Name: | Compania de Transport Public Cluj-Napoca S.A. |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Romanian |
Original Source: | Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO) |
Initial Contributor: | elu |
The DPA fined a Public Transport Company RON 19,902 (€4,006) as it had made video recordings of its employees at work for several years.
English Summary
Facts
The Romanian DPA started an investigation, after a tip concerning the presence of audio surveillance cameras directed to the driver are present in the driver booth of buses operated by the Cluj-Napoca S.A. Public Transport Company, the controller. These cameras system allowed for remote online monitoring.
During the several years during which the cameras were in place, the image and voice of employees of the controller were processed and, sometimes, resulted in the imposing of disciplinary procedures, at the expenses of employees.
Holding
The DPA considered that the prolonged and extensive data processing conducted by the controller with regards to the data subject´s data, violated the principles of legality, legitimacy as well as purpose limitation.
Thus, the DPA found a violation of Article 5(1)(a)(b)(c) and (2) and Article 6 GDPR in conjunction with Article 5(a) to (d) Law no. 190/2018, a national provision concerning data processing in the context of employment relations, and consequently imposed a fine of RON 19,902 (€4,006) on the controller.
The DPA further reiterated that processing personal data through camera surveillance can illegally and excessively affect other data subjects, in this case for instance passengers, which can prove problematic. It also provided for corrective measures to ensure compliance with the GDPR, such as “re-assessing the purposes” of processing through surveillance cameras, as well as “reconsidering the use of the audio option” in the cameras.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
12.12.2024 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing completed, in November 2024, an investigation at the operator Compania de Transport Public Cluj-Napoca S.A. and found a violation of art. 5 para. (1) let. a), b), c), para. (2) and art. 6, in conjunction with art. 5 let. a)-d) of Law no. 190/2018, in relation to the provisions of art. 83 para. (5) let. a) of Regulation (EU) 2016/679. As such, the operator was sanctioned with a fine in the amount of 19,902 lei, equivalent to the amount of 4,000 euros. The investigation was initiated following a complaint indicating that, at the level of the Cluj-Napoca Public Transport Company S.A., audio-video surveillance cameras are installed in the driver's cabin of vehicles, directed towards the driver, with the possibility of remote online monitoring. During the investigation, it was found that the operator illegally processed the personal data of a large number of employees in the position of driver, respectively the image and voice through the audio-video surveillance system installed inside the driver's cabins of public transport vehicles (trolleybuses and buses), in violation of the provisions of art. 5 para. (1) let. a), b), c), para. (2) and art. 6 of Regulation (EU) 2016/679, in conjunction with art. 5 let. a)-d) of Law no. 190/2018. Thus, over a period of several years, the processing of personal data of data subjects (employees) in the context of employment relationships was carried out by the operator in violation of the principles of personal data processing, regarding legality, legitimacy and limited to what is necessary in relation to the purposes for which the data are processed. It was also found that the images and sounds captured by the surveillance cameras were used by the operator for other purposes, including to the detriment of employees, within the framework of investigation and disciplinary sanction procedures. At the same time, it was noted that this method of processing personal data through the surveillance system installed in public transport may affect, due to its illegal and excessive nature, other categories of data subjects (passengers), in terms of collecting their sounds/voices through the installed cameras. The corrective measure was also ordered against the operator to ensure compliance with Regulation (EU) 2016/679 of the collection and further processing of personal data, by reassessing the need to achieve the proposed purposes, on the one hand, by using audio-video surveillance cameras installed inside the driver's cabins of public transport vehicles, and on the other hand, by using the audio option of the surveillance cameras installed in public transport vehicles, in accordance with the principles and conditions of legality provided for by the Regulation and by Law no. 190/2018. In this context, we reiterate that art. 5 of Law no. 190/2018, provides: “Processing of personal data in the context of employment relations If monitoring systems are used by means of electronic communications and/or by means of video surveillance at the workplace, the processing of employees’ personal data, for the purpose of achieving the legitimate interests pursued by the employer, is permitted only if: a) the legitimate interests pursued by the employer are well justified and prevail over the interests or rights and freedoms of the data subjects; b) the employer has carried out the mandatory, complete and explicit prior information of the employees; c) the employer has consulted the trade union or, as the case may be, the employees’ representatives before introducing the monitoring systems; d) other less intrusive forms and methods for achieving the purpose pursued by the employer have not previously proven their effectiveness; and e) the duration of storage of personal data is proportionate to the purpose of the processing, but not longer than 30 days, except in situations expressly regulated by law or in duly justified cases.” Legal and Communication Department A.N.S.P.D.C.P