07.05.2025

Sanctions imposed for non-compliance with the GDPR by public authorities

The National Supervisory Authority for Personal Data Processing completed, in 2025, two investigations at the controllers Poliția Locală a Municipiului Miercurea – Ciuc (Local Police of Miercurea Ciuc Municispality) and Poliția Locală a Municipiului Craiova (Local Police of Craiova Municipality) and found the breach of Article 5 paragraph (1) letter a), in relation to Article 6 paragraph (1) of Regulation (EU) 2016/679.

Both controllers were sanctioned with a reprimand, accompanied by a corrective measure, ordered by the remediation plan, namely to ensure the compliance of the processing operations carried out using portable audio-video systems of the body-cam type with the provisions of Article 5 and Article 6 of the General Data Protection Regulation.

The corrective measure was applied pursuant to the provisions of Article 58 paragraph (2) letters b) and d) of the General Data Protection Regulation, in conjunction with the provisions of Articles 12 - 14 of Law no. 190/2018.

The investigations carried out at the two controllers were initiated following the receipt of notifications regarding the violation of data protection legislation.

Thus, it was found that the controllers, through the personnel performing the missions and activities specific to the local police, processed personal data by using audio-video surveillance means of the “body-cam” type (image, voice), without there being a legal obligation on the controllers and without fulfilling any other conditions provided for in Article 6 paragraph (1) of Regulation (EU) 2016/679, although according to Article 5 paragraph (1) letter a) of the GDPR, the controllers had the obligation to process the data in a legal, fair and transparent manner towards the data subjects.

It was found that there is no express legal provision regarding the use of audio-video surveillance means in Law no. 155/2010 on the local police, with subsequent amendments and completions.

In contrast to this situation, in Law no. 218/2002 on the organization and functioning of the Romanian Police, republished, with subsequent amendments and additions, there is express legal authorization for the use of audio-video surveillance means (including body-cam type).

Thus, Article 56 of Law no. 218/2002 provides:

”(1) For the purpose of carrying out activities of prevention, detection, investigation or criminal prosecution of crimes or the execution of sentences, prevention and combating of other illegal acts, as well as of maintaining public order and safety:

a) the actions of the police officer in public spaces, as well as the intervention carried out under the conditions of Article 52 or for the execution of a warrant may be recorded with the photo-audio-video means provided, without the consent of the persons concerned;

b) the Romanian Police is authorized to record, occasionally, with photo-audio-video means or by other technical means provided, operative moments regarding public activities carried out in public places, without the consent of the persons concerned, in case there are probable grounds to suspect that crimes or other illegal acts could be committed in these public places or public order and safety could be disturbed. (...)

(3) The processing of personal data contained in photographic images or audio and/or video recordings for purposes other than those for which they were collected is prohibited, except in the cases expressly provided for by law and only if the necessary guarantees are ensured to protect the rights of the data subjects.

(4) The Romanian Police may keep photographic images or audio and/or video recordings obtained according to paragraph (1) or (2) for a period of 6 months from the date of their obtaining, except in the cases in which they are used in a judicial procedure, in which case they shall be subject to the regime of evidence. Upon the expiry of this term, the images and/or recordings shall be destroyed, through irreversible procedures.”

Similar situations were investigated by the National Supervisory Authority, in the sense of what is specified in the press releases that can be accessed using the links https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_2_22_12_2020&lang=en and https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_3_22_12_2020&lang=en.

It is worth mentioning that, previously, both the correctness of the sanctions and that of the corrective measures applied were confirmed by final court decisions, favorable to the National Supervisory Authority, pronounced in other similar situations.

In this context, we emphasize that the restriction of the fundamental rights to privacy and to the protection of personal data (enshrined in particular by the Treaty on the Functioning of the European Union, the Charter of Fundamental Rights of the European Union, the European Convention on Human Rights and the Constitution of Romania) can only be achieved by law, with strict compliance with the provisions of Article 53 of the Romanian Constitution.

In this regard, the Constitutional Court of Romania also ruled, through Decision no. 498/2018, which states, among other things:

“50. (...) It is noted that guarantees for ensuring the constitutional right provided for by Article 26 are included in a Government decision, but such a manner of regulation is totally inadequate, impermissibly weakening the constitutional protection of intimate, family and private life. In practice, the administrative authority can at any time modify the standards of guarantees associated with this right, by issuing normative administrative acts, the citizen/patient being thus at the pleasure of the administrative authority. However, an adequate protection of this right is that established by a law, which is not the case in the present case. Consequently, the criticized texts violate Article 26 of the Constitution.

52. Therefore, the legislator has the obligation to regulate the guarantees associated with the right to intimate, family and private life. This obligation must be materialized by law, in the sense of instrumentum.”

Legal and Communication Department

A.N.S.P.D.C.P