Considering the requests received from the public, regarding aspects on the supervision of the personal data processing operations performed by the judicial courts, within the exercise of their judicial competences, we hereby bring to the knowledge of the interested persons the following aspects:

Through the provisions of Article 34 paragraph (2) of Law no. 305/2022 on the Superior Council of the Magistracy (published in the Official Gazette, Part I no. 1105 of the 16^th of November 2022) it is established that: “The Superior Council of Magistracy is the competent authority for the supervision of personal data processing operations by the courts in the exercise of their judicial powers, in the sense of Article 55 paragraph (3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation.”

These provisions were issued within the application of Recital 20 and by reference to Article 55 paragraph (3) of the GDPR, following the proceedings of the National Supervisory Authority performed starting with year 2018.

According to Recital 20 of the GDPR ”(…) The competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of the judiciary in the performance of its judicial tasks, including decisionmaking. It should be possible to entrust supervision of such data processing operations to specific bodies within the judicial system of the Member State, which should, in particular ensure compliance with the rules of this Regulation, enhance awareness among members of the judiciary of their obligations under this Regulation and handle complaints in relation to such data processing operations.”

According to Article 55 paragraph (3) of the GDPR ”Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.”

By consequence, for the activity of processing of personal data performed by the judicial courts within the exercise of their judicial competences, the Superior Council for the Magistracy is the institution with supervision and control competences, that will monitor and verify the personal data processing activity performed by the judicial courts in Romania.

Therefore, to the extent that a data subject considers himself injured or does not receive an answer within the legal term to a request regarding the exercise of the rights provided under Article 12-22 of the GDPR, addressed to the courts, as personal data controllers, the data subject has the possibility to subsequently address a complaint to the Superior Council of Magistracy.

In this context, we mention that the National Supervisory Authority for the Processing of Personal Data has recently signaled to the Superior Council of Magistracy the need to update the information on the courts' own websites, as well as to ensure compliance with data protection rules, in application of the provisions of GDPR and Law no. 305/2022.

Legal and Communication Department

A.N.S.P.D.C.P.