The National Supervisory Authority for Personal Data Processing completed, in March 2025, an investigation at the controller Office Nova Concept SRL and found the breach of Article 12 paragraphs (1)-(4), in relation to Articles 21 and 17 of Regulation (EU) 2016/679.

As such, the controller was sanctioned with a fine in the amount of 4,977.4 lei (the equivalent of 1,000 euros).

The investigation was initiated following a complaint submitted by a natural person who reported that the controller had installed cameras facing the entrance to his home without his consent.

The data subject requested, by e-mail, the controller to reorient the cameras so that images from his personal home would no longer be captured. At the same time, the deletion of images of the people who used the entrance to the building was also requested.

During the investigation, it was found that the controller did not communicate a proper written response to the request of the data subject within the legal deadline, thus violating the provisions of Article 12 paragraphs (1)-(4) of Regulation (EU) 2016/679, in relation to Article 21 and Article 17 of the same European legal act.

At the same time, the controller was ordered to take the following corrective measures:

to send an appropriate response to the data subject’s request to the contact details indicated by him/her, in relation to the provisions of Article 21 and Article 17, in conjunction with Article 12 of Regulation (EU) 2016/679;
to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of appropriate training of the staff designated for this purpose, so that the controller is able to correctly manage and respond appropriately to requests by which data subjects exercise their rights, within the time limits and according to the conditions provided for in Articles 12-23 of Regulation (EU) 2016/679. Also, to ensure complete, transparent and accessible information to data subjects, according to Articles 12-14 of Regulation (EU) 2016/679, as appropriate, at all premises where it uses video surveillance cameras;
to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, so that video surveillance cameras installed at the address indicated by the data subject do not capture images from his property without their consent.

Legal and Communication Department

A.N.S.P.D.C.P