The National Supervisory Authority for Personal Data Processing completed, in January 2025, an investigation at the controller Liceul Vasile Conta din Târgu Neamț and found the breach of Article 5 paragraph (1) letters a) and c) and of Article 32 of the General Data Protection Regulation (GDPR).

As such, the controller was sanctioned with two reprimands for the contravention provided by Article 14 paragraph (5) letter a) of Law no. 190/2018 related to Article 5 paragraph (1) letters a) and c) of the GDPR and the contravention provided by Article 14 paragraph (2) letter a) of Law no. 190/2018 related to Article 32 of the GDPR.

The investigation was started as a result of an intimation that indicated that this high school processes personal data through the video surveillance system, including audio, the monitors being installed in the principal’s office and he has access (including on his personal phone) to the images captured in the hallways, stairwell and in the sanitary area.

During the investigation, it was found that the controller processed personal data (the image) by means of video cameras installed in the rooms intended for the sanitary group, illegally and excessively, by reference to the purpose for which the data were collected, thus violating the provisions of Article 5 paragraph (1) letter a) and c) of the GDPR.

It was also found that Liceul Vasile Conta Târgu Neamț did not implement adequate technical and organisational measures in order to ensure data confidentiality, including for limited and secure access to images and for the allocation of viewing monitors exclusively to authorised persons, thus violating the provisions of Article 32 of the GDPR.

At the same time, the following corrective measures were ordered against the controller:

the reviewing of internal procedures for the adoption of technical and organisational measures, in the meaning that personal data processed through the video surveillance are processed in accordance with the processing principles provided for in Article 5 of the GDPR;
the reviewing of internal procedures for the adoption of technical and organisation measures, including by ensuring limited and secure access to the processed images and the allocation of real-time image viewing monitors exclusively to authorised persons.

In this context, we mention that Article 66 paragraph (4) of Law no. 198/2023 on pre-university education provides that “Audio-video surveillance systems can be installed in the school space, as follows: in the classrooms, outside the buildings, in the halls, in the halls of festivities, in the halls of the dormitories or boarding schools, as well as in the sports halls, with the exception of the changing rooms and sanitary facilities.”

Regarding the sanctioning regime applicable to public authorities in Romania, we specify that it is regulated by Law no. 190/2018 which provides that public authorities are first sanctioned with a reprimand to which a remedial plan is attached (Article 13 of Law no. 190/2018).

Later, where the respective public institutions do not fully implement the measures provided for in the remedial plan, the National Supervisory Authority, depending on the circumstances of each individual case, may apply the sanction of fine from 10,000 lei to 200,000 lei (Article 14 of Law no. 190/2018).

Legal and Communication Department

A.N.S.P.D.C.P