Rights of individuals whose data is processed in the SIS II
Persons whose personal data are collected, held or otherwise processed in the second generation Schengen Information System (hereinafter „SISII”) are entitled to rights of access, correction of inaccurate data and deletion of unlawfully stored data. The ways of exercising these rights are described in the Guide for exercising the right of access.
Right of access
The right of access is the possibility for anyone who so requests to have knowledge of the information relating to him or her stored in a data file as referred to in national law. This is a fundamental principle of data protection which enables data subjects to exercise control over personal data kept by third parties. This right is expressly provided for in Article 53 of Regulation (EU) 2018/1861 and in Article 67 of Regulation (EU) 2018/1862.
Right to rectification and deletion of data
Besides the right of access, there are also the right to obtain the correction of personal data factually inaccurate or incomplete or the right to ask for deletion of personal data unlawfully stored (Article 53 of Regulation (EU) 2018/1861 and Article 67 of Regulation (EU) 2018/1862).
Under the Schengen legal framework only the Member State responsible for issuing an alert in the SIS may alter or delete it (See Article 44(3) of Regulation (EU) 2018/1861 and Article 59(3) of Regulation (EU) 2018/1862.
How to exercise the rights of access, rectification and deletion
Pursuant to Article 61 of Law no. 76/2023, the rights of access, rectification and deletion of the data of the persons concerned in the context of the processing of personal data in SINS or in SIS are exercised according to Regulation (EU) 2016/679 and Law no. 363/2018.
According to Article 62 of Law no. 76/2023, in order to handle the requests of the data subjects regarding the processing of personal data in the SINS or in the SIS, the Personal Data Protection Unit is established within the General Inspectorate of the Romanian Police.
The requests of data subjects in the context of the processing of personal data in the SINS or in SIS are sent to the Personal Data Protection Unit or to any competent national authority, which forwards the request to the Personal Data Protection Unit within 5 working days after the registration, informing the person concerned about it.
In order to communicate to the applicant the information regarding the personal data processed in the SINS or in the SIS, the Personal Data Protection Unit requests the consent of the national competent authorities that entered the alerts in question. The agreement is communicated within 20 days from the date of receipt of the request from the Personal Data Protection Unit.
In order to communicate to the applicant the information regarding the personal data entered in SIS by other member states or associated countries, the Personal Data Protection Unit requests, through the exchange of supplementary information, the opinion of the member state or associated country that introduced the alert.
The Personal Data Protection Unit communicates, within 40 days after receiving the request, the agreement regarding the transmission by another member or associated country of the personal data contained in or related to the alerts sent by the national competent authorities in SIS, only with their consent. The agreement is communicated within 20 days from the date of receipt of the request from the Personal Data Protection Unit.
Contact details of the body to which requests for access, rectification, deletion should be addressed
General Inspectorate of the Romanian Police
6 Mihai Vodă Street, 5th district Bucharest, PO 030167
Romania
E-mail: cererischengen@politiaromana.ro
Right to submit a complaint to the data protection authority
Pursuant to Article 65 of Law no. 76/2023, the legality of the processing of personal data in N.SIS on the territory of Romania and the transmission of this data abroad, as well as the exchange and subsequent processing of supplementary information are monitored and subject to the control of the National Supervisory Authority for Personal Data Processing.
Without prejudice to any other administrative or judicial remedy, any data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to them infringes the legal provisions applicable in the domain.
According to the Procedure for handling complaints, adopted by Decision no. 133/2018, when submitting the complaints, it is mandatory to specify in detail the subject matter, the actions taken by the petitioner at the level of the complainant data controller or processor, as the case may be, the information available to support the allegations, as well as to attachment of conclusive evidence.
The contact details of the National Supervisory Authority for Personal Data Processing are:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
28-30 G-ral Gheorghe Magheru Boulevard
1st district, Bucharest, PO 011336,
Romania
Tel.: +40 31 805 92 11
Fax: +40 31 805 96 02
E-mail: anspdcp@dataprotection.ro
Right to bring an action before the court
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, every data subject shall have the right to an effective judicial remedy if the data subject considers that the processing of personal data relating to them infringes the legal provisions applicable in the domain.
Pursuant to Article 64 of Law no. 76/2023, the competent courts recognize final decisions issued by competent courts in member states or associated countries regarding access, rectification, deletion, obtaining information or obtaining compensation in connection with a report, in accordance with Law no. 134/2010 regarding the Code of Civil Procedure, republished, with subsequent amendments and additions, respectively with Law no. 302/2004, republished, with subsequent amendments and additions. ANSPDCP recognizes the final decisions issued by the other competent institutions in the member states or associated countries.
