The National Supervisory Authority finalised, on 23.09.2021, an investigation at the controller Glove Technology SRL, following which it found the breach of the provisions of Article 5 paragraph (1) corroborated with Article 6 paragraph (1) of the General Data Protection Regulation, the controller being sanctioned with a fine in amount of Lei 24,745.00 (the equivalent of EUR 5,000).

The sanction was applied as it was found that the controller processed the personal data of its employees by using an audio-video system (image and voice), without proving the observance of the legal basis provided under Article 6 paragraph (1) of GDPR, respectively obtaining the consent of the data subjects, the fulfilling a legal obligation or the prevalence of its legitimate interest over the interests, rights and freedoms of the data subjects.

Also, it was found that the controller implemented the measure of employees’ monitoring at the workplace through audio-video surveillance systems without observing the principle stipulated by Article 5 paragraph (1) letter a) of GDPR, according to which the controller shall process the data lawfully, fairly and in a transparent manner in relation to the data subject.

Also, based on Article 58 paragraph (2) letter d) of GDPR, the corrective measure to ensure the conformity of the processing operations performed through the use of audio-video systems, as well as the cease of any personal data processing operation or operations set performed through the audio-video systems and the erasure of the personal data record systems established following the use of such systems was also ordered to the controller.

The investigation started following an intimation, through which it was indicated that the controller Glove Technology SRL has installed audio-video surveillance cameras inside the offices, in order to have a direct supervision of the employees at the work place where they perform their activity and a registration of the conversations between them, with the purpose of subsequently use them against those employees.

In this context, we underline that, to the extent that a controller uses monitoring systems through video surveillance means at the workplace, the personal data processing of the employees for the purpose of achieving the legitimate interests of the employer (Article 6 paragraph (1) letter f) of GDPR), is performed with the observance of the provisions of Article 5 of Law no. 190/2018 that establishes, as first condition, for the interests envisaged by the employer to be duly justified and to prevail over the interests or rights and freedoms of the data subjects.

Legal and Communication Department

A.N.S.P.D.C.P.