ANSPDCP (Romania) - Fine to ANPC (National Authority for Consumer Protection)
| ANSPDCP - Fine to ANPC (National Authority for Consumer Protection) | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(c) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | ANPC (National Authority for Consumer Protection) |
| National Case Number/Name: | Fine to ANPC (National Authority for Consumer Protection) |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | https://www.dataprotection.ro/?page=Comunicat_Presa_05_07_2023&lang=ro (in RO) |
| Initial Contributor: | Silvia Axinescu |
The Romanian DPA issued a warning and ordered the National Consumer Protection Authority (ANPC) to cease the use of body cameras during their investigations into companies.
English Summary
Facts
Starting in May 2023, the ANPC (controller) used body camera devices during on-site investigations performed with businesses. The devices recorded the respective control actions in order to be used as evidences by the ANPC.
Following complaints stating that ANPC breaches data protection legislation by using body camera devices, the DPA opened an investigation. The investigation showed that the recordings captured images of colleagues, employees or representatives of economic operators, as well as other private individuals, including children or adults within shops, swimming pools, restaurants, bars or salons. It also appeared that personal data processed through body camera devices were stored for more than 6 months, without any agreement and without any supervision.
Holding
The DPA assessed the legal basis for processing activities and considered that the controller did not prove that there were express legal provisions enabling the use of such devices in the context of its control actions. The processing was also not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The DPA found that the controller violated Articles 5(1)(a) and 6(a) GDPR and imposed a warning along with an order to cease any personal data processing activities performed through body camera devices and to delete personal data previously recorded as a result of the use of such devices.
Comment
Unfortunately, the Romanian DPA does not publish its full decisions. This summary is based on a press release.
The DPA published another press release regarding this decision.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
Ban ANPC - Body Cam In June 2023, the National Supervisory Authority completed an investigation at the operator of the National Authority for Consumer Protection (ANPC) and found a violation of the provisions of art. 5 para. (1) lit. a), referred to art. 6 para. (1) of Regulation (EU) 2016/679. ANPC was penalized for contravention with a warning, according to the provisions of Law no. 190/2018. The sanction was applied as a result of an investigation launched following notifications regarding the fact that the ANPC operator violates data protection legislation as it processes personal data through the use of body camera type devices "assigned to commissioners with control attributions in order to use in all control actions" and that "for more than 6 months ANPC commissioners have been recording controls and capturing in these images, without any consent and without any supervision, not only colleagues, employees or representatives of some economic operators, but also a lot of private persons, children or adults, in shops, at swimming pools, in restaurants, at bars or at salons". As part of the investigation, it was found that ANPC processes personal data collected through Body Camera devices (name and surname, function/quality, image, voice, and behavior), starting from May 2023, for the purpose of pre-reconstitution of evidence in related to control actions. The operator could not prove that the processing carried out with means of the Body Camera type has a basis in the domestic law applicable to it. The existence of any express legal provision was not found to provide for the use of portable Body Cam cameras, with audio-video recording function, in the ANPC activity, in relation to its specific attributions. As such, it was found that the processing of personal data (name, surname, function/quality, image, voice, behavior) through the portable audio-video surveillance system was carried out without a legal obligation of the operator, without the processing was carried out for the performance of a task that serves a public interest or that is part of the exercise of public authority and without fulfilling any other condition provided for in art. 6 para. (1) correlated with para. (3) of the GDPR. According to art. 5 para. (1) lit. a) of the GDPR, the operator had the obligation to process the data in a legal, fair and transparent manner towards the data subject. In addition to the warning sanction, the National Supervisory Authority for the Processing of Personal Data also applied a corrective measure, ordering the ANPC operator to cease any operation or set of personal data processing operations carried out by means of Body-type portable devices Cam with audio-video recording function and delete personal data from the record system established as a result of the use of such devices. The operator, the National Authority for Consumer Protection, has informed the National Authority for the Supervision of the Processing of Personal Data that it has carried out the ordered measure. In this context, regarding the use of body cam by public institutions, we mention that, following the investigations carried out by ANSPDCP, it was found that operators such as UAT Cluj (Local Police), UAT Constanța (Local Police) and Bucharest Sector 4 City Hall (Police Local) violated the provisions of art. 5 para. (1) lit. a) related to art. 6 para. (1) of Regulation (EU) 2016/679, because the Local Police personnel, in the exercise of specific missions and activities, processed personal data by using the portable audio-video system of the "Body-Worn Camera" type (image and voice ), without there being a legal obligation of the operator and without fulfilling any other conditions provided for in art. 6 para. (1) of the GDPR. We also point out that through final judgments from 2022 and 2023, the courts upheld the decisions of the ANSPDCP, which ordered the termination of processing and the deletion of images collected by the local police, following controls that found the lack of legality of the respective data processing ( in the disputes with UAT Cluj - Local Police and UAT Constanța - Local Police). Thus, the Constanța Court of Appeal ruled, among other things, in the decision given in the dispute between UAT Constanța and ANSPDCP that: "The decision represents the act by which the specific corrective measures are established and applied, in this case, to delete data, according to the provisions of art. 16 para. 6 of Law no. 102/2005, being issued on the basis of the facts and circumstances ascertained by the contravention report (...), act which found the violation of the law and the obligation to fulfill the remedial measures established by the remediation plan annexed to the contravention report." At the same time, the Bucharest Court of Appeal, in the dispute with UAT Cluj, decided that "(...) the defendant authority found a violation of Regulation (EU) 2016/679, because the staff of the General Directorate of Local Police Cluj-Napoca, located in carrying out specific missions and activities, processed personal data by using the "Body-Worn Camera" portable audio-video system (image and voice), starting from October 2019, without the operator having a legal obligation and without fulfilling any other condition provided for in Article 6 paragraph (1) of the RGPD, although according to Article 5 paragraph (1) letter a of the RGPD, the operator had the obligation to process the data in a legal, fair and transparent manner towards the data subject . Consequently, by the contested Decision, the applicant was required to cease any operation or set of personal data processing operations carried out by means of the "Body - Worn Camera" type audio-video systems and to delete the personal data record system constituted as a result of the use of such systems." Legal and Communication Department A.N.S.P.D.C.P.
