DATA PROTECTION IN SEPTEMBER 2023
By Mugurel Olariu, RPD protectie date
At the level of specialized institutions, national – ANSPDCP *1 and european – EDPB *2, activities were carried out, work tools were adopted and sanctions were ordered, of which we mention:
On a national level, ANSPDCP has published the Activity Report for 2022 *3, which presents the activity carried out, as follows:
The annual report contains a synthetic presentation of the Authority’s activity, being structured in accordance with the main competences, in the following chapters: Chapter I – General presentation, Chapter II – Regulatory activity, approval, consultation and public information, Chapter III – Monitoring and control activity , Chapter IV – Activities in the field of international relations, Chapter V – Economic management of the Authority and Chapter VI – Ferenda law proposals.
Also, the Activity Report for 2022 contains the presentation of some cases from the investigations carried out, as well as the most relevant points of view issued, which reflect the complexity of the activity carried out, by referring to the attributions of our institution.
Regarding the monitoring and control activity, in 2022 the Authority received a total number of 4260 complaints, notifications and notifications regarding security incidents, based on which 629 investigations were opened.
As a result of the investigations, 69 fines were imposed in the total amount of 1,058,863 lei. Also, 134 warnings were issued and 93 corrective measures were ordered.
At the same time, we specify that, during 2022, a number of 948 requests to issue points of view were addressed to the National Supervisory Authority regarding various aspects related to the method of interpretation and application of Regulation (EU) 679/2016, by operators and their proxies, from the public and private sector, by other entities, as well as by natural persons.
Also, the Authority issued opinions on a number of 107 draft normative acts developed by institutions and public authorities that involved various aspects regarding the processing of personal data, pursuant to art. 57 para. (1) lit. c) from Regulation (EU) 2016/679.
Regarding the activity of representation before the courts, the National Authority for the Supervision of the Processing of Personal Data managed in 2022 a number of 108 files pending before the courts in different procedural stages.
Also, the Authority published on its website, in the News section, the results of some investigations completed in September, with a series of sanctions applied to the following operators:
✔ UAT Albeni Commune – the violation of the provisions was found: art. 58 para. (1) lit. a) and lit. e) from Regulation (EU) 2016/679 and art. 14 para. (5) lit. e) from Law no. 190/2018; and art. 13, art. 14 and art. 32 of Regulation (EU) 2016/679.
The controller was sanctioned contraventionally with a fine in the amount of 10,000 lei for the fact that he did not carry out the measures previously ordered by the Authority through a remedial plan and for not responding to the Authority’s requests and with a warning for the lack of informing the persons concerned about their rights provided by Regulation (EU) 2016/679, as well as for not adopting adequate security and confidentiality measures for the protection of personal data processed through the video surveillance system.
✔ RESTART ENERGY ONE S.A. – the violation of the provisions of art. 32 para. (1) lit. b) and letter d), in conjunction with art. 32 para. (2) of Regulation (EU) 2016/679, as well as of art. 4 para. (5) from Law no. 506/2004 on the processing of personal data and the protection of private life in the electronic communications sector, amended and supplemented.
As such, the controller was sanctioned contraventionally with: a fine of 124,150 lei, the equivalent of 25,000 EURO, for the violation of art. 32 para. (1) lit. b) and d), in conjunction with art. 32 para. (2) from Regulation (EU) 2016/679; and with a fine of 40,000 lei for violating art. 4 para. (5) from Law no. 506/2004.
✔ Cez Vânzare S.A. – the violation of the provisions of art. 32 para. (1) lit. b) and art. 32 para. (2) of Regulation (EU) 2016/679. As such, the controller was penalized with a fine of 4,969.70 lei (equivalent to 1,000 EURO).
On a European level, the EDPB in the plenary session of September 19-20, also adopted the following instruments:
➢ EDPB-EDPS *4 Joint Opinion 01/2023 on the proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016 / 679 *5;
➢ Guidelines 01/2023 on Article 37 of the Law Enforcement Directive *6; version 1.0 of the guide is under public consultation from 27 September to 8 November.
➢ Joint EDPB-EDPS contribution to the public consultation on the draft template relating to the description of consumer profiling techniques (Article 15 DMA) *7;
The Croatian Supervisory Authority imposed an administrative fine on the data controller – EOS Matrix Debt Collection Agency in the amount of EUR 5,470,000.00 due to the violation of Articles 5, 6, 9, 12, 13 and 32 of the GDPR *8:
Case origin:
On March 22, 2023, the Croatian Supervisory Authority (SA) received an anonymous petition stating that there was an unauthorized processing of a large number of personal data of natural persons (debtors) by EOS Matrix doo, the agency debt collection (data operator). The petition was accompanied by a USB stick containing 181641 personal data of natural persons in the structure of first and last name, date of birth and personal identification number, who had outstanding debts to credit institutions that were acquired by EOS Matrix doo on the basis of assignment contracts. In addition, the petition in question stated that 294 individuals included in the database were minors at the time the database was compiled.
Key Findings:
✔ The data controller has not implemented sufficient technical measures in the processing system (the main database in which the personal data of approximately 370,000 data subjects are processed) that can identify activities that deviate from the usual ones (for example , increased number of data fetches in the database, transfer of data outside the system, compromise of user access, etc.). This was found to be contrary to Article 32 of the GDPR.
✔ It was established that the data controller also processed personal data of natural persons who are not debtors nor legal representatives of the heirs in debtor-creditor relationships and for this processing there is no legal basis according to art. 6(1) of the GDPR.
✔ It was established that the data controller actively recorded comments regarding the state of health of the debtor (certain data subjects). In addition, the health status of the subjects concerned was tracked with details of individual diagnoses, which included terminal illnesses and for which processing activity there was no applicable exception under Article 9(2) of the GDPR.
✔ By examining the first three privacy policies (which were in force between May 2018 and October 2020), it was determined that the data controller defined in these documents that they do not and will not process health data. Therefore, the processing of personal data was non-transparent, which is not in accordance with Article 12(1) and Article 13(1) and Article 13(2) GDPR.
———————————————————————–
1. ANSPDCP – Supervisory Authority for the Processing of Personal Data.
2. EDPB. – European Data Protection Board.
3. https://www.dataprotection.ro/?page=Rapoarte%20anuale&lang=ro
4. EDPS – European Data Protection Supervisory.
5. https://edpb.europa.eu/ourwork-tools/our-documents/edpbedpsjoint-opinion/edpb-edps-joint-opinion-012023-proposal_ro
6. https://edpb.europa.eu/ourwork-tools/documents/public-consultations/2023/guidelines-012023-article-37-law-enforcement_ro
7. https://edpb.europa.eu/our-worktools/our-documents/other/joint-edpbedps-contribution-public-consultationdraft-template_ro
8. https://edpb.europa.eu/news/national-news/2023/croatian-sa-imposedadministrative-fine-data-controller-debtcollection_ro
