ANSPDCP (Romania) - Office Nova Concept
| ANSPDCP - Office Nova Concept | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12 GDPR Article 17 GDPR Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 14.04.2025 |
| Fine: | 4,977 RON |
| Parties: | Office Nova Concept SRL |
| National Case Number/Name: | Office Nova Concept |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | cci |
The DPA fined a company RON 4,977 (€1,000) for capturing CCTV footage of a neighbor without their consent and for failing to respond to their erasure request.
English Summary
Facts
The company Office Nova Concept SRL (the controller) installed CCTV cameras on its premises. Some of the cameras were oriented towards a nearby home and captured footage of the resident (the data subject) who never consented to being recorded.
The data subject reached out to the controller and requested that it moved the cameras away from its home. The data subject also requested the erasure of all the recordings of his person. The controller did not respond to the requests.
Holding
The DPA held that the controller violated Articles 12, 17, and 21 GDPR by failing to respond to the data subject's requests.
The DPA ordered the controller to prevent the cameras from capturing footage of the data subject without their consent, and to respond to the data subject's request for erasure. Additionally, the DPA ordered the controller provide information about the use of the cameras to any other data subject, and to take steps to ensure that data subject requests are handled correctly in the future (including instructing its staff).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
14.04.2025 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing completed, in March 2025, an investigation at the operator Office Nova Concept SRL and found a violation of the provisions of art. 12 para. (1)-(4), in relation to art. 21 and art. 17 of Regulation (EU) 2016/679. As such, the operator was sanctioned with a fine in the amount of 4,977.4 lei (equivalent to 1,000 EURO). The investigation was initiated following a complaint submitted by a natural person who reported that the operator had installed cameras facing the entrance to his home without his consent. The data subject requested, by e-mail, the operator to reorient the cameras so that images from the personal home would no longer be captured. At the same time, the deletion of images of the people who used the entrance of the building was also requested. During the investigation, it was found that the operator did not communicate a proper written response to the data subject's request within the legal deadline, thus violating the provisions of art. 12 para. (1)-(4) of Regulation (EU) 2016/679, in relation to art. 21 and art. 17 of the same European regulatory act. At the same time, the operator was also ordered to take the following corrective measures: to send a proper response to the data subject's request to the contact details indicated by the data subject, in relation to the provisions of art. 21 and art. 17, in conjunction with art. 12 of Regulation (EU) 2016/679; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of appropriate training of the staff designated for this purpose, so that the operator is able to correctly manage and respond appropriately to requests by which data subjects exercise their rights, within the time limits and under the conditions provided for in art. 12-23 of Regulation (EU) 2016/679. Also, to ensure complete, transparent and accessible information to data subjects, according to art. 12-14 of Regulation (EU) 2016/679, as appropriate, at all premises where it uses video surveillance cameras; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, so that the video surveillance cameras installed at the address indicated by the data subject do not capture images from his property without his consent. Legal and Communication Department A.N.S.P.D.C.P.
