ANSPDCP (Romania) - S.C. Tip Top Food Industry S.R.L
| ANSPDCP - ANSPDCP - S.C. Tip Top Food Industry S.R.L | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(c) GDPR Article 5(1)(b) GDPR Article 5(2) GDPR Article 6 GDPR Article 7 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 15.04.2021 |
| Fine: | 5000 EUR |
| Parties: | S.C. Tip Top Food Industry S.R.L |
| National Case Number/Name: | ANSPDCP - S.C. Tip Top Food Industry S.R.L |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP - Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO) |
| Initial Contributor: | Diana Rosu |
The Romanian DPA fined a company €5000 (RON 24,362.50) for violating the data minimisation principle. The DPA held that CCTV surveillance in a workplace is excessive and does not respect the data minimisation principle when employees are recorded in spaces like cloakrooms or dining areas. Additionally, consent given by employees for such processing cannot be considered freely given.
English Summary
Facts
A company was using CCTV surveillance in order to protect its assets and to prevent theft. The monitored area included spaces like offices, cloakrooms, or dining areas where employees would normally work, but also spend their breaks and free time. The data processing was based on the employees' consent.
Dispute
Holding
The DPA found that there has been a violation of Article 5(1)(b), 5(1)(c), 5(2), 6 and 7, considering that recording employees in spaces like cloakrooms, or dining areas was not necessary for the purpose pursued, and the same result could have been achieved through other measures less intrusive in the employees' private life.
In addition, the DPA found that consent cannot be considered a valid legal base in the context of the imbalanced relationship between employer-employee. Consequently, the controller was not able to prove the lawfulness of the processing.
Finally, a fine of RON 24.362,50 (approx €5000) was imposed, together with two corrective measures:
- the controller must implement the data minimisation principle in its data processing activities;
- the controller must adjust the monitored area in order to prevent surveilling the employees in the cloakrooms, or dining areas.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
The Romanian Supervisory Authority has completed an investigation of the controller S.C. Type Top Food Industry S.R.L and found a violation of the provisions of art. 5 par. (1) lit. b) and c) and par. (2), art. 6 and art. 7 of the General Data Protection Regulation.
As such, the controller S.C. TIP TOP FOOD INDUSTRY S.R.L. was sanctioned with a fine of 24,362.50 RON (the equivalent of 5,000 Euros).
Following the investigation, the Romanian Supervisory Authority found that the controller processed the image of its employees excessively through video cameras installed in locker rooms and in the dining area, for the purpose of protecting the company's goods and products, as well as and discouraging theft.
In this context, the Romanian Supervisory Authority considered that the processing of personal data was not adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed ("data minimisation"), thus violating the principles of art. 5 par. (1) lit. b) and c) of the General Data Protection Regulation. The Romanian Supervisory Authority considered that the stated purpose of the controller (protection of the company's goods, products and deterrence of theft) could be achieved by less intrusive means for the privacy of employees.
On the other hand, in the investigation, taking into account the employer-employee relationship, it was noted that the consent of the data subject could not be considered freely given and no other legal basis for processing could be identified, as the controller could not prove compliance for the processing, by reporting to art. 5 par. (2) of the General Data Protection Regulation.
The following corrective measures were also applied to the controller:
- the corrective measure to ensure the conformity of the personal data processing operations in the video monitoring activity, respecting the principle of “data minimisation”, reported to art. 5 par. (1) lit. c);
- to reanalyze the orientation of the angle of capturing the video images so that they do not monitor the activity of its employees in the spaces with the destination of locker rooms and in the dining room, related to the purpose of processing.
The investigation was initiated following a complaint from an individual who reported that the company S.C. TIP TOP FOOD INDUSTRY SRL processes personal data (respectively the image), through the video cameras installed in the employees' offices, in the locker rooms and in the dining room.
