ANSPDCP - Asociația de proprietari Bl. FC 5, orașul Năvodari, județul Constanța

From GDPRhub
ANSPDCP - n/a
LogoRO.jpg
Authority: ANSPDCP (Romania)
Jurisdiction: Romania
Relevant Law: Article 5 GDPR
Article 6(1) GDPR
Article 12 GDPR
Article 13 GDPR
Article 25 GDPR
Article 32 GDPR
Article 83(4)(a) GDPR
Article 83(5)(a) GDPR
Article 83(5)(b) GDPR
Type: Investigation
Outcome: Violation Found
Decided: 04.08.2020
Published: 01.09.2020
Fine: 500 EUR
Parties: Asociația de proprietari Bl. FC 5, orașul Năvodari, județul Constanța
National Case Number/Name: n/a
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): Romanian
Original Source: Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO)
Initial Contributor: n/a

The Romanian DPA (ANSPDCP) fined an apartment building owners association €500 for illegally processing the image of a data subject.

English Summary[edit | edit source]

Facts[edit | edit source]

The owners association of an apartment building had extracted an image of a data subject from its video surveillance system, and then posted the image on the notice board of the building. Furthermore, an application made it possible for the images to be accessed remotely through the internet.

Dispute[edit | edit source]

Was the posting of the image on the notice board of the building lawful in accordance with Articles 5, 6, 12, 13, 25, and 32 GDPR?

Holding[edit | edit source]

The ANSPDCP first held that the processing of the image coming from the video surveillance system occurred unlawfully, as it breached Articles 5 and 6(1) GDPR. For this violation, the DPA used its powers under Article 82(5)(a) and fined the association with €500.

Second, the ANSPDCP held that the controller breached Articles 25 and 32 GDPR by not adopting adequate technical and organisational security measures to protect the personal data captured by the video surveillance system. For this violation, the DPA referred to Article 83(4)(a) and issued a warning. In addition, the ANSPDCP ordered the controller to adopt appropriate protective measures, such as deactivating the application that allowed the images to be remotely accessed through the internet and limiting the number of people who have access to the system.

Third, the DPA held that the controller breached Articles 12 and 13 GDPR by failing to adequately inform data subjects who were filmed by the video surveillance system of the association. In this context, the ANSPDCP made a reference to Article 83(5)(b) GDPR and issued a warning. In addition, the DPA also used its corrective powers and ordered the controller to provide data subjects, within 15 days and in a visible place, with complete information with regards to the personal data processing of the video surveillance system.

Comment[edit | edit source]

Share your comments here!

Further Resources[edit | edit source]

Share blogs or news articles here!

English Machine Translation of the Decision[edit | edit source]

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

On 4.08.2020, the National Supervisory Authority completed an investigation at the Owners Association Bl. FC 5, Năvodari city, Constanța county, in which it found a violation of certain provisions of the General Regulation on Data Protection.

As such, the owners' association was sanctioned:

for the illegal processing of the image of a natural person, coming from the video surveillance system of the association, by posting on the notice board of the building, in violation of the principles of personal data processing provided by art. 5 of the RGPD, corroborated with art. 6 para. (1) of the RGPD, by reference to the provisions of art. 83 para. (5) lit. a) from RGPD - fine in the amount of 2417.55 lei (equivalent to 500 euros) ;
for not adopting security, technical and organizational measures, adequate for the protection of personal data collected through the video surveillance system, in accordance with the provisions of art. 25 and 32 of the RGPD, by reference to the provisions of art. 83 para. (4) lit. a) of the RGPD - warning ;
for the lack of a complete information of the data subjects whose personal data they process through the video surveillance system held, according to the requirements of art. 12 and 13 of the RGPD, by reference to the provisions of art. 83 para. (5) lit. b) of the RGPD - warning .
At the same time, the following corrective measures were applied to the owners' association :

to ensure the complete information of the data subjects, by providing all the information provided by art. 12-13 of the RGPD, in a visible place, near the installed surveillance cameras, within 15 days from the date of communication of the minutes
to ensure the compliance with RGPD of processing operations by adopting security measures, technical and organizational, appropriate for the protection of personal data collected through the video surveillance system, including in terms of viewing images via the monitor located in the lobby and deactivating the application allowing remote access to images via the Internet, by establishing, within the General Assembly of the Owners Association, a limited number of people who have access to this system, the rights that can be allocated to each of them, the provision clear processing instructions for persons processing data under the authority of the association.
The sanctions were applied as a result of a complaint by which the petitioner claimed access to, use and disclosure by various persons, without legal grounds, of images with his person, from the video surveillance system of the owners' association.

 

Legal and communication department

A.N.S.P.D.C.P.