The National Supervisory Authority finalised on the 29th of November 2019 an investigation to a Association of Owners and ascertained the infringement of certain disposition of the General Data Protection Regulation.

The Association of Owners was sanctioned as follows:

for the contravention found pursuant to Article 12 of Law no. 190/2018, by reference to the dispositions mentioned in Article 83 paragraph (5) letter a) of GDPR – fine in the amount of 2389.05 lei, the equivalent of 500 euros;
for the contravention found pursuant to Article 12 of Law no. 190/2018, by reference to the dispositions mentioned in Article 83 paragraph (5) letter b) of GDPR – reprimand;
for the contravention found pursuant to Article 12 of Law no. 190/2018, by reference to the dispositions mentioned in Article 83 paragraph (4) letter a) of GDPR – reprimand.

The sanctions were imposed following a complaint by which the petitioner claimed the access, use and disclosure to various persons, without a legal basis, of images with his person, from the video surveillance system of the Association of Owners.

Following the investigation it was found that the Association of Owners did not adopt appropriate technical and organisational measures for the protection of personal data collected through the video surveillance system.

At the same time, the following corrective measures were applied to the Association of Owners:

corrective measure to ensure compliance with the GDPR of the processing operations carried out through the video surveillance system in the sense of informing the data subjects pursuant to Articles 12 and 13 of the GDPR, including by posting warning and information notes near the places where the video cameras are installed, within 10 working days from the date of communication of this report (Article 58 paragraph (2) letter d) of the GDPR);
corrective measure to ensure compliance with the GRPD of the processing operations by adopting adequate security, technical and organisational measures in order to protect the personal data collected through the video surveillance system, including the integration of the data protection principles (such as the storage limitation of the recordings), the establishment of a limited number of persons having access to this system, of the rights that can be granted to each of the person, of providing certain clear instructions for processing for the persons which process date on its behalf in order to avoid the access, dissemination or processing in an unauthorised way the personal data processing through this system, pursuant to Article 25 and Article 32 of GDPR, within 30 days from the date of communication of this report (Article 58 paragraph (2) letter d) of GDPR).

A.N.S.P.D.C.P.