Home » procedura_de_solutionare_a plangerilor
 Română | English | Francais

Notices and complaints handling

 

Article 1 – (1) For exercising the powers provided by Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of such data, amended and completed and Law no. 102/2005 regarding the setting up, organisation and functioning of the National Supervisory Authority for Personal Data Processing, amended and completed, the National Supervisory Authority for Personal Data Processing, hereafter ANSPDCP, receives and solves petitions, notices or requests with reference to the processing of personal data falling under Law no. 677/2001 or of other legal provisions applicable in the data protection field. 

(2) Within the activity of receiving, analysing and handling the complaints, notices and requests, the dispositions of Government Ordinance no. 27/2002 concerning the regulation of the activity of complaints handling, approved by Law no. 233/2002, amended and completed, are applicable in the situations in which Law no. 677/2001 or Law no. 102/2005 provides otherwise.

(3) This procedure is applicable only for handling complaints, notices and requests falling under the competence of the Investigations’ Department, according to Article 13 b) and g) of the Regulation on the organisation and functioning of the National Supervisory Authority for Personal Data Processing, approved by the Decision of the Standing Bureau of the Senate no. 16/2005.

(4) The petitions submitted based on Law no. 544/2001 regarding the free access to information of public interest, amended and completed other that the complaints, notices and requests regulated by the present procedure, are handled according to Decision no. 103 of the 31st of August 2006 of the president of ANSPDCP regarding the information of public interest which can be communicated and the information excepted from communication.

 

Article 2 – (1) The complaints are addressed to ANSPDCP by natural persons (persons whose personal data are processed) and may concern the infringement of the provisions of Law no. 677/2001 with reference to the assurance of the features of the data processed, of the legitimacy of the personal data processing, of the confidentiality and security of the personal data processed, as well as with reference to the no observance of one or more rights provided by law.

(2) The notices may be submitted to ANSPDCP by natural persons other that the data subjects or by the entities legally constituted and may refer to the way the data controllers apply the law.

(3) The request referring to the activity of carrying prior checks, investigations, as well as the ones referring to complaints and notices handling defined according to paragraph (1) and (2) are of the competence of the Investigations’ Department and are handled, as the case may be, according to the present procedure or according to the Government Ordinance no. 27/2002 concerning the regulation of the activity of complaints handling approved by Law no. 233/2002, amended and completed.

(4) Depending on the object of the complaints, notices and requests defined in paragraph (1)-(3), in order to handle them, the Investigations’ Department may ask for the cooperation of other departments within ANSPDCP.

 

Article 3 – (1) The complaints, notices and requests must be addressed in written to ANSPDCP, by observing the conditions provided by law and may be transmitted by post, including electronic post, on-line or submitted to our institution premises accompanied by evidence, as the case may be.

(2) The complaints, notices and requests may be submitted personally or through a representative, by mentioning the name, surname, domicile or correspondence address and the signature of the natural persons or, by care, the name, headquarters and the correspondence address, signature and stamp of the legal person.

(3) Where the complaints, notices and requests are submitted through a representative, its identification details are mandatory (name, surname, domicile or correspondence address/ name, headquarters and the correspondence address), by attaching the empowerment signed by the concerned person.

(4) Where the complaints, notices and requests are submitted by electronic mail or on-line, beside the data provided in paragraphs (1) and (2), it is mandatory to provide a valid electronic address in order to contact the petitioner. ANSPDCP may ask for the confirmation of the correctness of the data transmitted by electronic mail or on-line.

(5) Where the complaints, notices and requests that have as object the violation of the right to personal, family and private life in the electronic communications domain, beside the data provided in paragraphs (1) and (2), is it mandatory to provide the telephone or fax number/numbers, of the electronic address/addresses, of the IP address/addresses connected to the object of the petition.

(6) Where the complaints, notices and requests that have as object the violation of the right to personal, family and private life by receiving unsolicited commercial communications, is it mandatory to attach the original messages received by the petitioner, which should be preserved, to the possible extent, in the electronic evidence system used by him.

(7) Where the complaints, notices and requests are addressed by telephone or during the public relations program of ANSPDCP, the designated persons from the supervisory authority will inform the petitioners about the necessity to respect the procedure presented in this article.

 

Article 4 – (1) The complaints, notices and requests, with the envelopes attached for the ones submitted by mail, are registered on the day they were received in the general register of ANSPDCP, with a number and date, including in the information application for documents management.

(2) Where the complaints, notices and requests are submitted by electronic mail or on-line in a nonworking day, they will be registered in the first working day according to the procedure presented in paragraph (1).

(3) The complaints, notices and requests that do not state the identification details of the petitioner, namely the name, surname, domicile or correspondence address are considered to be anonymous. They will not be registered, being classified with this mention at the general registration office of ANSPDCP and they archived in the general archive of ANSPDCP.

(4) The complaints, notices and requests registered according to paragraphs (1) or (2) and to which the present procedure is applicable, shall be presented to the cabinet of the president, on the day of their registration, and, following the resolution of the president or of the person designated by him, shall be assigned to the head of the Investigations’ Department, through the information application for documents management and through the book of entry, under signature.

(5) The head of the Investigations’ Department shall assign the complaints, notices and requests to the subordinated employees, by establishing the handling time frame, through the book of entry, under signature and also through the information application for documents management.

(6) Where the complaints, notices and requests concern aspects from the activity of an employee of ANSPDCP, the petition should not be assigned to that particular person.

(7) Where the petition assigned to another department fulfils the conditions provided by law and the present procedure is order to make the object of an investigation, the responsible of the file shall propose the reassignment to the Investigations’ Department through a memo addressed for approval to the president of ANSPDCP, with the signature of the head of the department to which he belongs.

(8) Where the proposal provided in paragraph (7) is approved, the memo together with the file of the complaint or notice is transmitted to the Investigations’ Department which will hereafter act according to the procedure for carrying out investigations and prior checks, approved by decision of ANSPDCP.

(9) The delivery and the reception of the petitions between departments are done by the book of entry and under signature, as well as through the information application.

 

Article 5 – (1) The person to whom the complaint, notice or request was assigned, hereinafter “the responsible of the file” shall analyse its subject and shall propose a answer which will be submitted for approval to the head of Investigations’ Department.

(2) Where the responsible of the file finds out from the complaint or notice and/or the annexes that, before registering the petition to ANSPDCP, a claim concerning the same matter and parties was previously submitted to a court of law, the responsible of the file shall propose to reject it as invalid, according to the conditions stipulated by Article 25 (2) and Article 27 (2) of Law no. 677/2001, by a memo submitted for approval to the president of ANSPDCP following the proper hierarchy.

(3) Where the responsible of the file finds out that the petitioner does not certify that he has previously address the matter to the data controller, according to Article 25 (3) of Law no. 677/2001, he proposes to the head of the department, through the answer, the rejection as invalid and shall ask the petitioner to carry out the prior procedure.

(4) If, following a respectful analysis of all the circumstances noted through the complaint submitted according to paragraph (3), it is ascertain that a delay would cause imminent or irreparable damage for the data subject, the responsible of the file shall propose through a not submitted for approval to the president of ANSPDCP following the proper hierarchy to carry out an investigation on writing or in situ.

(5) Where the complaint or the notice fulfils the conditions provided by law, the responsible of the file shall propose to carry out an investigation on writing or in situ through a memo submitted for approval to the president of ANSPDCP, with the signature of the head of the Investigations’ Department.

(6) For the requests defined in Article 2 (3) of the present procedure, the responsible of the file shall propose an answer submitted for approval by the head of the Investigations’ Department.

(7) Where the responsible of the file finds out that the complaint, notice or request exceeds the legal competence of ANSPDCP shall propose to head of the department, through the answer proposal, the rejection as invalid, with motivation.

 

Article 6 – (1) In all the situations, the concerned person is informed in writing by the Investigations’ Department about the due diligences for handling the complaints, notices or requests analysed, according to Article 5, within 30 day from the registry date to ANSPDCP.

(2) Where a petitioner addresses several petitions, noticing the same issue, they are connected and the petitioner shall receive only one answer which should refer to all the petitions received.

(3) For the petitions referring to a previous petition to which an answer was given, without providing new evidence, the responsible of the file shall propose to the head of the Investigations’ Department to classify them, under the conditions of Government Ordinance no. 27/2002.

(4) The replies to the petitions shall be sent by the general registration office of ANSPDCP.

 

Article 7 – (1) During the course of the procedure of solving the complaint or notice, the responsible of the file may propose the data subjects to be heard or their representatives or hearing the data controller, his/her representative, the data processor (as the case may be), as well as carrying out an expertise in order to clarify the issues under investigation.

(2) The proposal for a hearing or conducting an expertise is made through a written memo, thoroughly justified and submitted to the head of the Investigations’ Department.

(3) The hearing carried out in under the conditions set out in paragraph (2) is documented by the responsible of the file within a written memo also signed by the persons heard and registered at the General Registry of ANSPDCP.

(4) Expertises are carried out observing the provisions of Government’s Ordinance no. 2/2000 on the organisation of the activities of judiciary and extra-judiciary technical expertise, approved by Law o. 156/2002.

(5) In duly justified cases, during the course of solving the complaint or notice, the responsible of the file may propose issuing a Decision on the total or partial suspension of the processing undergoing verification, under the conditions set out in Article 25 paragraph (7) of Law no. 677/2001, through a written memo, dully grounded and submitted to the approval of the president of ANSPDCP, with the prior signature of the head of the Investigations’ Department.

(6) If the memo provided in paragraph (5) is approved, copies of all relevant documentation are attached to it and sent to the Legal and Communication Department. within no longer than 3 working days from the date the memo is approved, in order to issue the Decision in writing and thoroughly motivate it, which is then brought to the attention of the data controller.

 

Article 8 – (1) In the situations in which, after the procedure for solving complaints and notices has been followed, the complaint/notice is found to be grounded, the ANSPDCP may impose one of the measures provided by Article 21 of Law no. 677/2001.

(2) The measures provided under paragraph (1) are imposed through a Decision issued by the president of ANSPDCP, issued in written form and thoroughly grounded.

(3) The Decision provided under paragraph (2) is drafted by the Legal and Communication Department, based on a report drafted by the responsible of the file, signed by the head of the Investigations’ Department, approved by the president of ANSPDCP and sent within 3 working days to the Legal and Communication Department from the date of its approval.

(4) The Decision is sent to the body of whose activity it refers to, by the Legal and Communication Department.

 

Article 9 – The measures taken in accordance with the provisions of Articles 7 and 8 of this procedure will be brought to the petitioner’s attention through a written letter, drafted by the Investigations’ Department after all of the measures required to solve the petition have been taken, within the deadlines provided by law.

 

Article 10 – This procedure is complemented with the provisions of the procedure on carrying out investigations and prior checks, approved through a Decision of the president of ANSPDCP.