22.12.2020
Sanction imposed to a public authority
On the 11th of December 2020, the national supervisory authority finalised an investigation to UAT Sector 4 Municipiul București (Administrative-Territorial Unit 4th District of Bucharest), represented by the Mayor, for the General Directorate of Local Police 4th District and found the violation of the provisions of Article 5 paragraph (1) letter a) in connection with Article 6 paragraph (1) of the General Data Protection Regulation.
The controller was sanctioned with a reprimand together with the following corrective measure, ordered through the remediation plan, respectively to ensure the compliance of the processing operations performed by using the means of audio-video surveillance of “BADGE” type with the provisions of Articles 5 and 6 of the GDPR.
The corrective measure was imposed pursuant to the provisions of Article 58 paragraph (2) letter i) of the General Data Protection Regulation, in conjunction with the provisions of Articles 12-14 of Law no. 190/2018 on implementing measures to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
The investigation was launched following the receipt of an intimation regarding the violation of the data protection legislation and it was found that the General Directorate of Local Police 4th District processes personal data through portable audio-video surveillance means of “BADGE” type, used by the staff of the Directorate in missions and activities carried out in the field, in the context in which the local police officers were hierarchically established the obligation to carry on them, during the working hours, these means of audio-video surveillance.
At the time of the investigation, it was found that there are no legal provisions governing the use of portable audio-video surveillance systems in the activity of local police officers.
As such, it was found that the processing of personal data (image, voice) was carried out without meeting the conditions of legality of the processing, as provided in Article 6 paragraph (1) of the GDPR. We stress that, according to Article 5 paragraph (1) letter a) of the GDPR, the controller had the obligation to process the data lawfully, fairly and in a transparent manner in relation to the data subject.
In accordance with the above, Recital (41) states that a legislative measure should be clear and precise and its application should be foreseeable to persons subject to it, in accordance with the case-law of the Court of Justice of the European Union (the ‘Court of Justice’) and the European Court of Human Rights.
Furthermore, Recital (45) of the GDPR states that: “Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law. This Regulation does not require a specific law for each individual processing. A law as a basis for several processing operations based on a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority may be sufficient. It should also be for Union or Member State law to determine the purpose of processing. Furthermore, that law could specify the general conditions of this Regulation governing the lawfulness of personal data processing, establish specifications for determining the controller, the type of personal data which are subject to the processing, the data subjects concerned, the entities to which the personal data may be disclosed, the purpose limitations, the storage period and other measures to ensure lawful and fair processing.”
Legal and Communication Department
A.N.S.P.D.C.P.
