ANSPDCP (Romania) - fine against Domeniul Public și Privat SA
| ANSPDCP - fine against Domeniul Public și Privat SA | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(2) GDPR Article 6 GDPR Article 12 GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 20.03.2026 |
| Fine: | 15,285 RON |
| Parties: | Domeniul Public și Privat SA |
| National Case Number/Name: | fine against Domeniul Public și Privat SA |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | dt |
The DPA fined a company a total of RON 15,285 (€3,000) for the unlawful use of body-cams, failure to inform its employees and unlawful disclosure of an employee’s personal data to a doctor. In addition, the DPA warned the controller about the recording of disciplinary review meetings.
English Summary
Facts
The Romanian DPA (ANSPDCP) received a complaint from an employee (the data subject) of the company Domeniul Public și Privat SA (the controller) regarding multiple possible breaches of the GDPR.
Subsequently, the DPA launched an investigation into the controller.
The DPA's investigation showed that the controller carried out video surveillance on its employees through the use of body-cams, recorded disciplinary review meetings of its employees without providing complete prior information to participants and disclosed without authorisation an employee's personal data to their general health practitioner.
Holding
The DPA fined the controller RON 10,190 (€2,000) for the unlawful use of body-cams and for its failure to inform employees about said use of cameras in breach of Article 5(1)(a) GDPR, Article 5(1)(c) GDPR, Article 12 GDPR and Article 13 GDPR.
In this sense, the DPA found that the controller processed excessively the personal data of employees through the use of body-cams while less intrusive means of checking compliance with health and safety measures were available. Moreover, the DPA found that the controller failed to inform its employees in an adequate manner regarding those audio and video recordings.
Moreover, the DPA fined the controller an additional RON 5,095 (€1,000) for unlawfully disclosing the data subject’s personal data to their general health practitioner in breach of Article 5(1)(a) GDPR, Article 5(1)(c) GDPR, Article 6 GDPR, Article 12 GDPR and Article 13 GDPR.
In addition, the DPA warned the controller regarding the infringement of Article 12 GDPR and Article 13 GDPR for the incomplete information provided about the recording of disciplinary review meetings.
Finally, the DPA ordered the controller to ensure compliance with the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
20.03.2026 Sanctions for violation of the GDPR The National Supervisory Authority completed an investigation in February 2026 at the operator Domeniul Public și Privat SA and found a violation of the provisions of art. 5 para. (1) let. a) and c) and para. (2), art. 6, art. 12 and art. 13 of Regulation (EU) 2016/679. As such, the operator was sanctioned as follows: with a fine in the amount of 10,190 lei (equivalent to 2,000 euros) for violating the provisions of art. 5 para. (1) let. a), c) and para. (2) and of art. 12-13 of Regulation (EU) 2016/679, for the illegal use of a body-cam and the lack of related information to employees; with a warning for violating the provisions of art. 12-13 of Regulation (EU) 2016/679, for incomplete information regarding the audio-video recording of disciplinary investigation meetings; with a fine of 5,095 lei (equivalent to 1,000 euros) for violating the provisions of art. 5 para. (1) let. a), c) and para. (2), art. 6 of the GDPR and the information conditions provided for in art. 12-13 of Regulation (EU) 2016/679, for the unauthorized disclosure of data to the employee's family doctor. The investigation was initiated following a complaint submitted by an employee of the company, who reported several possible violations of Regulation (EU) 2016/679. As a result of the investigation, it was found that the operator had excessively processed the data of its employees by using a video camera (body-cam), although there were less intrusive means for the purpose of verifying occupational health and safety standards. The company also failed to properly inform the employees about the video-audio recordings that were to be made. Thus, the principles of legality, proportionality and the obligation to inform were violated, in relation to art. 5 and art. 12-13 of Regulation (EU) 2016/679. At the same time, during the investigation, it was found that the operator had provided incomplete information regarding the recording of disciplinary investigation sessions, in relation to the provisions of art. 12-13 of Regulation (EU) 2016/679. Also, during the investigation, it emerged that the controller had disclosed the personal data of an employee to his family doctor in an unauthorized manner. At the same time, the following corrective measures were also applied to the controller: to ensure compliance with Regulation (EU) 2016/679 of the personal data processing operations, so as to avoid in the future the unlawful, excessive and non-transparent processing of personal data of employees, through the use of body-cam cameras, in which sense the appropriate training of the persons who process data under the authority of the controller will be ensured, with the involvement of the data protection officer; to ensure compliance with Regulation (EU) 2016/679 of the personal data processing operations, by ensuring a clear legal basis established by reference to art. 6, 7 and, where applicable, art. 9, 10 of Regulation (EU) 2016/679, in relation to the possibility of recording disciplinary investigation meetings on electronic media, establishing limited periods of storage of records in relation to the purpose of processing, providing full and appropriate prior information to all data subjects, in accordance with the provisions of art. 12-13 of Regulation (EU) 2016/679 and respecting the rights of data subjects, including the right of access to these records according to art. 15 of the same European regulation; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, so as to avoid in the future the unlawful, excessive and non-transparent disclosure of personal data of employees, meaning that appropriate training will be ensured for persons who process data under the authority of the controller, with the involvement of the data protection officer. Legal and Communication Department A.N.S.P.D.C.P.
