Submitting complaints to ANSPDCP
The General Data Protection Regulation establishes a unique set of rules for the effective protection of privacy of natural persons in the European Union.
The General Data Protection Regulation confers natural persons more rights, respectively:
- right of access (Article 15);
- right to rectification (Article 16);
- right to erasure (“right to be forgotten” – Article 17);
- right to restriction of processing (Article 18);
- right to data portability (Article 20);
- right to object (Article 21);
- right not to be subject to a decision based solely on automated processing (Article 22).
In order to exercise these rights, the natural person must address the data controller who processed his/her personal data with a request.
The controller shall provide information to the data subject no later that one month after receiving the request and, if it does not intend to comply with the request, to justify its refusal. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
Where the data subject:
- is dissatisfied with how the request was handled or
- it did not receive a response from the data controller,
- he/she has the possibility to file a complaint with the National Supervisory Authority.
The complaints to the National Supervisory Authority can be addressed by any data subject, who considers that the processing of his/her personal data violates the legal provisions in force, especially if his habitual residence, his place of work or the alleged infringement is or, as the case may be, takes place on the territory of Romania.
The complaint is filed personally or by a representative (with the attachment of the power of attorney issued under the conditions of the law by a lawyer or a notary proxy, as the case may be).
The complaints may also be filed by the representative of the data subject who is a spouse or relative up to second degree inclusive, under the conditions of Article 3 of Decision no. 133/2018 ont the approval of the Procedure for handling complaints.
Complaints must be made in writing, in Romanian or English.
The complaints may be filed at the general registry at the headquarters of the National Supervisory Authority or may be sent by post, including electronic mail, or by using the electronic form available on the website of the authority, under section Complaints https://www.dataprotection.ro/index.jsp?page=procedura_plangerilor.
Pursuant to Decision no. 133/2018 of the President of the National Supervisory Authority, when submitting complaints it is mandatory:
- to specify in detail the subject matter,
- to specify the he actions taken by the petitioner (the data subject) at the level of the complainant data controller or processor,
- to specify the information available to support the allegations,
- to attachment of conclusive evidence to the extent that he/she holds.
For valid receipt and registration of complaints, it is mandatory:
- to provide the following data of the petitioner: name, surname, postal address of domicile or residence; where the complaint is submitted electronically, it is mandatory to provide the petitioner’s e-mail address;
- to provide the identification data of the complainant data controller or processor, such as name and surname/name, address/headquarters, or at least the available information held by the petitioner for identification;
- in the case of complaints submitted by a representative, to provide the following data of the representative: name and surname/name, postal address of correspondence/headquarters, e-mail address, telephone number, registration number in the register of associations and foundations.
The submitted complaints shall be signed by handwriting or by electronic means, and, in the case of electronically submitted petitions that can not be signed, the National Supervisory Authority may request the confirmation of the correctness of the data transmitted electronically.
The petitioners may request the confidentiality of certain expressly mentioned personal data provided through the complaint, except for the cases where, for the proper solving of the subject matter of the complaints submitted, the petitioner’s identification data must be disclosed to the complainant entity.
The supervisory authority shall inform the data subject about the admissibility of the complaint, within 45 days from its registration, according to the provisions of Article 9 of Decision no. 133/2018.
If it is found that the information in the complaint or the documents submitted is incomplete or insufficient, the National Supervisory Authority shall require the data subject to complete the complaint in order for it to be considered admissible in order to conduct an investigation. A new deadline of no more than 45 days shall run from the date of completing the complaint.
The National Supervisory Authority shall inform the data subject about the progress or outcome of the investigation, within three months from the date on which it was notified that the complaint is admissible.
Where a more detailed investigation or coordination with other supervisory authorities is required, the National Supervisory Authority shall inform the data subject about the progress of the investigation, every three months, until it is finalized.
The complaint that does not specify the identification data of the petitioners (name, surname, postal address of domicile or residence), is considered anonymous and is classified with this mention without any reply to the petitioners, pursuant to the provisions of Article 10 of Decision no. 133/2018.
The procedure for handling complaints is regulated by Decision no. 133/2018 of the President of the National Supervisory Authority, published in the Official Journal no. 600 of 13th of July 2018 and available on the website of the Authority www.dataprotection.ro, Section Legislation/ANSPDCP Decisions, https://www.dataprotection.ro/index.jsp?page=procedura_plangerilor
The on-line complaint form is available here https://www.dataprotection.ro/index.jsp?page=Plangeri_RGPD
Legal and Communication Department