Personal Data Protection
Privacy and protection of personal data has become a very stressful area for most businesses after the entry into force of the new European General Data Protection Regulation (GDPR) on May 25, 2018.
The dramatic change in the personal data protection philosophy requires every company to adopt a new and more responsible approach, considering the special sanctioning regime that can bring fines up to 4% of the turnover of the preceding fiscal year or up to €20 million, whichever is greater.
In this context, we provide a broad range of services in managing and protecting personal information for our clients, multinational and local companies, including:
- Legal opinions on a variety of information privacy and data protection issues pertinent to businesses, with the goal of guiding clients.
- Assistance in process mapping, drafting of rules, procedures, guidelines, and policies for the prudent management of databases and data processing activities.
- Advice on negotiating commercial agreements that raise privacy and personal data protection issues, including global considerations regarding data processing activities, the use of cloud services and cross-border flows of information.
- Training of employees on data processing activities and procedures required by law and recommended best practices in the fields of data protection and information privacy.
- Litigation and legal representation in court proceedings involving data protection and privacy matters.
Frequently Asked Questions
Does my company need to appoint a Data Protection Officer in Romania?
Under GDPR Regulation (EU) 2016/679, a Data Protection Officer is mandatory for public authorities, for organizations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for those processing special categories of data or criminal records on a large scale. Other companies may appoint one voluntarily. The DPO's contact details must be published and communicated to the Romanian supervisory authority (ANSPDCP), and the DPO must be able to act independently and report to top management.
How quickly must a personal data breach be reported in Romania?
Under the GDPR, the controller must notify the supervisory authority (ANSPDCP in Romania) without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals. If the risk is high, the affected individuals must also be informed without undue delay. Every breach, including those not reported, must be documented internally. Processors must inform the controller without undue delay after becoming aware of a breach.
Can an employer monitor employees' emails or use video surveillance in Romania?
Yes, but only within strict limits. Besides the GDPR, Romanian implementing legislation sets specific conditions for monitoring employees through electronic communications or video systems, including a legitimate interest that clearly outweighs employees' rights, prior and complete information of employees, consultation of the trade union or employee representatives, and limited retention of recordings. Monitoring must be proportionate and less intrusive measures should be considered first. The European Court of Human Rights addressed these issues in Bărbulescu v. Romania.
What are the penalties for GDPR violations in Romania?
The GDPR sets two tiers of administrative fines: up to €10 million or 2% of worldwide annual turnover, and up to €20 million or 4% of worldwide annual turnover, whichever is higher. In Romania, fines are imposed by ANSPDCP, which can also issue warnings, order corrective measures or limit processing. The amount depends on factors such as the nature and duration of the breach, intent or negligence, and cooperation with the authority. Sanctions can be challenged in court.