The activity report for 2022 is publicly available on the website of the National Supervisory Authority for Personal Data Processing under section “General information/Public information/Annual reports”.

The annual report contains a synthetic presentation of the Authority’s activity, being structured in accordance with the main competences of ANSPDCP, in the following chapters: chapter I – General presentation, chapter II – Advisory, consultation and public information activity, chapter III – Monitoring and control activity, chapter IV – Foreign affairs activity and chapter V – The economic management of the Authority.

Within this Report there are statistical benchmarks highlighted in each chapter, including graphics compared to previous years such as: the number of investigations performed in total or differentiated (ex officio, respectively based on complaints), the number of complaints, intimations and notifications for security breach incidents received, the fines applied, the amount of the fines, reprimands, corrective measures, the number of points of view issued, the number of approvals issued, the number of pending litigations, the number of press releases.

Also, the 2022 Annual Report contains the presentation of some case-laws/cases from the investigation activity performed, as well as the most relevant points of view issued, which reflect the complexity of the activity performed, in connection with the tasks of our institution.

Regarding the control and monitoring activity, during 2022 there has been submitted to the National Supervisory Authority a number of 4,260 complaints, intimations and notices for security incidents, based on which 629 investigations were opened.

Following the investigations, 69 fines in total amount of Lei 1,058,863 were applied. Also, a number of 134 reprimands and 93 corrective measures were ordered.

Also, we mention that during 2022, a number of 948 requests for opinions regarding various aspects referring to the manner of interpretation and enforcement of the Regulation (EU) 2016/679 by the controllers and their processors, from the public and private sector, by other entities, as well as by natural persons, was addressed to the National Supervisory Authority.

Also, our institution has issued opinions in relation to a number of 107 legal acts drafts prepared by public institutions and authorities that involved complex aspects regarding the processing of personal data, under Article 57 paragraph (1) letter c) of Regulation (EU) 2016/679.

Regarding the activity of representation in front of the judicial courts, the National Supervisory Authority for Personal Data processing handled in 2022 a number of 108 files pending before the courts in different procedural stages.

The activity report for 2022 has been provided to the competent authorities, according to the provisions of Article 5 paragraph (2) of Law no. 102/2005 regarding the set up, organisation and functioning of the National Supervisory Authority for Personal Data Processing.

Legal and Communication Department

A.N.S.P.D.C.P.