During 8^th-10^th of June 2023, the representatives of the National Supervisory Authority for Personal Data Processing participated at the National Conference “The protection of personal data within the Romanian university education system – challenges and perspectives” organised by the Babes-Bolyai University from Cluj.

At this conference, many universities represented mainly by data protection officers were invited, as well as representatives of the Ministry of Education and of the National Directorate for Cybersecurity.

With this occasion, subjects regarding the protection of personal data within the Romanian university education system were approached. Thus, the following aspects were subject of the debate: the protection of data during the use of the IT and Internet of things technologies; the protection of personal data during the process of handling of the education process; the role, place and relevance of the activity of the data protection officer within the Romanian universities; the protection of personal data within the process of handling of the research activities and of the projects with European/external funding.

The representatives of the Authority brough to the attention of the participants the fact that each controller has the obligation to establish retention terms for each data processing that it performs, to correctly identify the legal basis for the processing by reference to the activities performed, to perform evaluations following the training of the employees in relation to the processing of data, to perform impact assessments when necessary, to perform a complete information of the data subjects.

Also, the importance of the position of the data protection officer was underlined, in the sense that the latter responds directly to the highest level of the controller’s management and, also, it was recommended that, depending on the complexity of the personal data processing performed at the level of the controller and its size, to take into consideration the creation of an independent department with attributions specific for the data protection officer.

Legal and Communication Department

A.N.S.P.D.C.P.