Within the litigation that is currently in front of the courts, the first court (Bucharest Tribunal) maintained the report of the National Supervisory Authority for Personal Data Processing through which it was found that ANPC collected numerous personal data from the intimations and claims received, by using the WhatsApp application, that is not under its control, without taking into account the risks involved, thus breaching the provisions of Article 32 paragraph (2) from the GDPR.

Therefore, for the deed found in 2022, the National Supervisory Authority for Personal Data Processing ordered the reprimand sanction, based on Law no. 190/2018, accompanied by the corrective measure to process the personal data only by using some personal data processing means that are under its control, including by applying adequate technical and organizational measures in order to guarantee and to be able to prove that the processing is performed according to the GDPR.

The investigation was started following some intimation through which it was reported that ANPC decided to allocate some mobile numbers, in order to receive some intimations, although ANPC was disposing of other means for the submission of the petitions (email, online, on the website, post). This information was also mentioned in the press releases posted on the webpage of ANPC.

Considering the findings of the National Supervisory Authority for Personal Data Processing, contained within the control report, the first instance court rejected as ungrounded the contestation submitted by ANPC.

In this context, regarding the ensurance of the compliance with the GDPR of the processing operations by WhatsApp Ireland – this company was subject to the investigation of the Data Protection Authority from Ireland, thus being found the breach of the transparency principle provided under Article 5 paragraph (1) letter a) from the GDPR and, implicitly, of the right to information of the data subjects located on the territory of various Member States, a sanction with a significant fine of EUR 25 millions being established.

Considering the aspects presented above, the National Supervisory Authority for Personal Data Processing draws the attention on the fact that, in the context of the processing of personal data, by using as processing mean the messenger application WhatApp, by reference to the principle of the responsibility of the controller, the processing under this manner can affect the right to private life and the protection of the data of the natural persons, by reference to the processing principles provided under the Regulation (EU) 2016/679. (GDPR).

Legal and Communication Department

A.N.S.P.D.C.P.