ANSPDCP (Romania) - Fine against Kaufland Romania SCS: Difference between revisions

Latest revision as of 10:23, 26 January 2022

ANSPDCP (Romania) - Fine against Kaufland Romania SCS

Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 15(3) GDPR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	20.01.2022
Fine:	3000 EUR
Parties:	Kaufland Romania SCS
National Case Number/Name:	Fine against Kaufland Romania SCS
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	Diana Rosu

The Romanian DPA issued a fine of approximately €3,000 to a supermarket for violating a data subject's right of access under Article 15(3) GDPR by failing to provide video footage in which they appeared.

English Summary

Facts

A data subject made an access request asking to receive a copy of the video recordings from when they visited a Kaufland supermarket.

Kaufland refused to offer all the existent footage that included the data subject, arguing that disclosing such material would affect the rights and freedoms of the other individuals who were also captured in that video footage.

Holding

The Romanian DPA decided that a controller should take all the necessary technical and organisational measures when answering an access request to make sure the personal data and rights of others are not affected. The DPA suggested that, in cases like these, in order to provide the claimant with the personal data in their access request, this could be solved by blurring the image of other individuals appearing in the footage.

Therefore, the Romanian DPA held that Kaufland did not fulfill their obligation to grant the data in the claimant's access request in breach of Article 15(3) GDPR, and imposed a fine of approximately €3000 in local currency on the supermarket chain.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.






20.01.2022 & # 13;
Sanction for RGPD & # 13;
& # 13;
The National Supervisory Authority completed in December 2021 an investigation at the operator Kaufland Romania SCS and found a violation of the provisions of art. 15 para. (3) of the General Data Protection Regulation, regarding the right of access. & # 13;
As such, the operator was sanctioned with a fine of 14846.4 lei (equivalent to 3000 EURO). & # 13;
The investigation was initiated following a complaint from a data subject that the operator did not provide a full copy of the video recordings for a certain time during which it was in the commercial premises. & # 13;
In the investigation, it was considered that it is the obligation of the operator to communicate a video containing images concerning the data subject, as a result of the exercise of the right of access by him, and the communication of images can be done by the operator by taking shutter action ( "Blurring") of those images that could infringe the rights and freedoms of other individuals, if any. Therefore, the operator is obliged to adopt a series of technical and organizational measures, in order to allow the full exercise of the access right of the data subject, while respecting the rights of other individuals. & # 13;
As such, the National Supervisory Authority found that the operator did not fully communicate the respective video recordings requested, which constitutes a violation of art. 15 para. (3) of the General Data Protection Regulation. & # 13;
& # 13;
Legal and Communication Department & # 13;
A.N.S.P.D.C.P.

@@ Line 48: / Line 48: @@
 }}
-The Romanian DPA fined Kaufland Romania approx €3000 for not providing a complete video footage during a data access request. If disclosed, the full recordings would have included and compromised other individuals' images. However, the DPA argued that technical measures could have been implemented to blur such data.
+The Romanian DPA issued a fine of approximately €3,000 to a supermarket for violating a data subject's right of access under [[Article 15 GDPR#3|Article 15(3) GDPR]] by failing to provide video footage in which they appeared.
 == English Summary ==
 === Facts ===
-A data subject made an access request, willing to receive a copy of the video recordings from when they were visiting the controller's supermarket (Kaufland).
+A data subject made an access request asking to receive a copy of the video recordings from when they visited a Kaufland supermarket.
-Kaufland refused to offer the all the existent footage that including the data subject, arguing that other individuals were captured in those videos, and disclosing such material would affect their rights and freedoms.
+Kaufland refused to offer all the existent footage that included the data subject, arguing that disclosing such material would affect the rights and freedoms of the other individuals who were also captured in that video footage.
 === Holding ===
-The Romanian DPA decided the a controller shall take the necessary technical and organisational measures when answering an access request, to make sure the other individuals' personal data and rights are not affected. The DPA suggested that, in such cases, other individuals' images could have been blurred.
+The Romanian DPA decided that a controller should take all the necessary technical and organisational measures when answering an access request to make sure the personal data and rights of others are not affected. The DPA suggested that, in cases like these, in order to provide the claimant with the personal data in their access request, this could be solved by blurring the image of other individuals appearing in the footage.
-Therefore, Kaufland did not fully answer an access request from a data subject, in breach of article 15(3) GDPR and was fined RON 14 846,4 (approx €3000).
+Therefore, the Romanian DPA held that Kaufland did not fulfill their obligation to grant the data in the claimant's access request in breach of [[Article 15 GDPR#3|Article 15(3) GDPR]], and imposed a fine of approximately €3000 in local currency on the supermarket chain.
 == Comment ==