Home » Procedures » Control
 Română | English | Francais

PROCEDURE FOR CARRYING OUT INVESTIGATIONS AND PRELIMINARY CONTROLS

 

CHAPTER I - GENERAL DISPOSITIONS

Article 1 In exercising the control attributions provided by Law no. 677/2001 on the protection of individuals with regard to the processing of personal data and the free movement of such data, as modified and amended, hereafter named Law. No 677/2001, and by Law no. 102/2005 on the setting up, organisation and functioning of the National Supervisory Authority for Personal Data Processing, as modified and amended, hereafter named Law no. 102/2005, the National Supervisory Authority for Personal Data Processing, hereafter named NSAPDP, carries out investigations and preliminary controls, observing the provisions of this procedure.

Article 2 (1) The Investigations' Department will make proposals during the last week of each month for a minimal plan of investigations for the next month, and by the 25th December of each year for a general plan of investigations for the following year.

(2) Apart from the planned investigations, other investigations may also be carried out based on the cases with require immediate checking of certain data processing. The investigations carried out in order to solve complaints or intimations have priority over those planned ex officio. In the case of investigations carried out in order to solve complaints or intimations, other issues may also be checked if it is noticed that they are infringements of the provisions of Law no. 677/2001.

(3) The investigation plans mentioned in pargraph (1) are submitted to the approval of the president of the NSAPDP.

Article 3 The Investigations' Department maintains a record of the investigations and preliminary controls carried out.


CHAPTER II - PROCEDURE FOR CARRYING OUT INVESTIGATIONS AND PRELIMINARY CONTROLS

SECTION 1: Common Rules

Article 4 (1) The investigations are carried out at the proposal of:

a) the Department for data controllers' and data processing's records, in accordance with article 12 letter d) of the Regulation of organisation and functioning of the NSAPDP;

b) the Investigations' Department, in accordance with article 13 letter a) of the Regulation of organisation and functioning of the NSAPDP;

c) the Authorisations' Department, in accordance with article 14 letter c) of the Regulation of organisation and functioning of the NSAPDP;

d) other interested persons.

(2) The intimation of the Investigations' Department in the cases mentioned in paragraph (1) is made through a grounded memo, approved by the president of the NSAPDP and communicated to or, as the case may be, approved by the head of the Investigations' Department.

(3) The Investigations' Department wmakes proposals for the persons that will carry out the investigation or preliminary control, as well as for the objectives of the control action, through the draft empowerment signed by the head of the Investigations' Department and submitted to the approval of the president of the NSAPDP. The empowerment is signed by the president of the NSAPDP or the person especially assigned by him/her.

(4) The persons assigned to be part of the control team have the obligation of informing in advance the president of the NSAPDP of the existence of certain reasons that may determine a conflict of interests, in accordance with Law no. 102/2005, with regard to the preliminary control/investigation for which they were assigned, in order to change the composition of the control team.

(5) It is forbidden to carry out investigations and preliminary controls outside the limits provided by the empowerment.

(6) The model/templates for the control badge and empowerment are provided in annex no. 1 and annex no. 2 to this procedure.

Article 5 (1) In carrying out the preliminary contol or investigation, the control team of the NSAPDP performs the following activities:

a) trip to the premises of the controlled body;

b) presentation of the control badge and empowermernt to the representatives of the controlled body who will also assign the competent persons(s) that will provide information in the controlled field. These persons will participate to the control by providing the information and documents requested by the control team and sign on the control documents issued;

c) mentioning in the control register of the controlled body of the data provided by article 3 paragraph (2) of Law no. 252/2003 on the unique control register;

d) verification of all issues mentioned in the empowerment by requesting any information linked to the control's objective;

e) verification of any document or recording referring to the processing of personal data, which is linked to the control's objective;

f) prelevation of documents or recordings relevant to the control's objective;

g) issuing the minute of ascertaing/sanctioning minor offences/contraventions;

h) applying sanctions licarea de sancţiuni, dacă este cazul, de către persoana împuternicită în acest sens;

i) handing over/communication to the offender of a copy of the minute of ascertaing/sanctioning minor offences/contraventions and of communication of the obligation to pay;

j) issuing the recommendations required in order to remedy the deficiencies noticed, as the case may be;

k) proposals on issuing decisions or instructions, in accordance with article 8 of this procedure;

l) following the observance of the measures disposed as a result of preliminary controls/investigations;

m) communication of the results of preliminary controls/investigations to the person or department that proposed the control action, in accordance with article 4 paragraph (1) of this procedure.

(2) The members of the control team have the following obligations:

a) to request the registering and stamping of the empowerment and, as the case may be, of the travel order;

b) to maintain contact with the supervisory authority and communicate any special situation occurred in relation to the control;

c) to have a decent behaviour;

d) to maintain the professional secrecy for an unlimited time over the confidential or classified they had access to;

e) to fill in the minute of ascertaining/sanctioning minor offences, by highlighting the situations presented by the controlled body, the declarations made by its representatives and of their own findings, as the case may be;

f) to confront the mentions made in the minute of ascertaining/sanctioning minor offences with the documents in the records of the supervisory authority, if it is necessary;

g) to annex to the minute of ascertaining/sanctioning minor offences the evidence that sustains the findings therein;

h) to make use, during on the spot investigations, of the IT means provided by the NSAPDP, namely portable computer and printer, in order to draft the minute of ascertaining/sanctioning minor offences. In exceptional cases, in which the trip isn't made with an automobile of the NSAPDP, the minute of ascertaining/sanctioning minor offences will be written by hand; in this situation, the control team has the obligation to draft a document containing the main findings and sanctions applied, withihn 10 working days from when the control was carried out, in order to ensure the accuracy of the recordings within the internal document management IT program.

(3) In the cases in which the control action is not an unforeseen one, the preliminary control/investigation will be carried out at the date and time announced by the NSAPDP.

(4) As an exemption to the provisions of paragrph (1), the preliminary control or investigation may be carried out at the premises of the NSAPDP, in cases justified by a memo of the head of the Investigations' Department, based on the empowerment provided in article 4 paragraph (3). In this situation, the representatives of the contolled body will be summoned at the premises of the NSAPDP.

(5) In certain situations, the preliminary control or investigation may be carried out through a written procedure, under the conditions provided in article 4. This consists of reqesting certain information, data and documents required in order to solve the case submitted to investigation or preliminary control, in writing and within a deadline established by the NSAPDP.

(6) Finalisation of the preliminary control or investigation carried out in accordance with paragraph (4) or (5) may consist in issuing the minute of ascertaining/sanctioning minor offences under the conditions provided in article 15 of this procedure.

Article 6 In the situation in which the data subjects, controlled body or their representatives request some expertise to be carried out, these will be made at the expense of that person, with the observance of the conditions provided by the normative acts on the organisation of the activity of judicial technical expertise and extra judicial expertise.

Article 7 (1) The control team may propose, if necessary, through a memo submitted to the head of the Investigations' Department, the hearing of the data subject, of the data controller and, if necessary of the data processor or the association or foundation that represents the interests of the data subject.

(2) The hearing carried out under the conditions of paragraph (1) is recorded by the control team within a hearing's note, signed inclusively by the heard persons and which will be recorded and included in the file of the control action.

(3) The hearing's outcome will be recorded in the report made in the cases mentioned in this procedure.

Article 8 (1) In all situations in which it is considered necessary, the control team will propose through a report submitted for the approval of the president of the NSAPDP, with the assent of the head of the Investigations' Department, the issuing of recommendations, opinions, decisions, compulsory instructions or other measures to correct the noticed deficiencies, with the observance of the legal deadlines.

(2) In exceptional cases, the acts mentioned in paragraph (1), as well as the minutes of ascertaining/sanctioning minor offences, toghther with notices on obligations of payment, will be communicated to the controlled body via "officers of the court".

SECTION 2: Specific rules on carrying out preliminary controls

Article 9 (1) The NSAPDP carries out preliminary controls in cases in which personal data processing that may present special risks to the rights and liberties of individuals, established by decision of the president of the NSAPDP, are notified.

(2) The preliminary control is compulsory and prior to the beginning f the data processing and is carried out under the conditions of article 4 paragraphs (3)-(6) of this procedure. The preliminary control is proposed by the Department for data controllers' and data processing's records or by the Authorisations' Department through a written memo submitted to the head of the Investigation' Department, whilst observing the provisions of the decision of the president of the NSAPDP mentioned in paragraph (1).

(3) The bodies submitted to a preliminary control will be informed of this by post, e mail or fax, as the case may be, within 5 days from the date the notification is registered at the NSADPD. The information will contain the date on which the preliminary control will be carried out, as well as the obligation not to begin the processing of personal data notified to the NSAPDP.

(4) The control team verfifies the operations provided in paragraph (1), with regard to the following issues:

a) observation od the legal provisions on processing personal data which are susceptible to risk;

b) adoption of additional security measures.

(5) In the case in which a minor offence has been noticed, the persons empowered to do so will apply a sanction through the minute of ascertaining/sanctioning minor offences.

Article 10 (1) Based on the findings included in the minute of ascertaining/sanctioning minor offences issued as a result of the preliminary control in accordance with the provisions of article 15 of this procedure, the control team may propose, in a report submitted to the approval of the president of the NSAPDP, with the assent of the head of the Investigations' Department, the following:

a) issuing a decision on beginning the processing of personal data, under the conditions mentioned in the notification;

b) issuig a decision on beginig the processing of personal data, under other conditions than those mentioned in the notification;

c) issuing a decision on the interdiction to begin the processing of personal data;

d) authorisation of the transfer abroad of personal data, in the cases in which the control had such an object, under the conditions mentioned at letter a) or b), as the case may be.

(2) The acts issued in the enforcement of pargarph (1) are signed by the president of the NSAPDP, with the asset of the head of the competent department, as the case may be, and the respective mention will be made within the records of the NSAPDP.

(3) In all cases, the acts issued in the enforcement of paragraph (1) will be transmitted to the controlled body within a maximum of 30 days from the date on which the notification was registered at the NSAPDP.


SECTION 3: Specific rules on carrying out investigations

Article 11 (1) The NSAPDP carries out investigations in the cases in which the verification of the processing of personal data is reauired, regardless of the fact that a preliminary control has been carried out or not.

(2) The investigation may be carried out eiher ex officio or in order to verify complaints or notices.

(3) Observance of the legal provisions by data controllers under the authority of the data controllers will be verified within the investigation, with regard to or security of the processed data, as well as the rights of the data subjects.

Article 12 (1) The ex officio investigation is carried ou in order to verify certain data and information with regard to the processing of personal data, obtained by the NSAPDP from other sources than those that constitute the object of a complaint or a notice.

(2) The data and information mentioned in paragraph (1) may be gathered from notifications, the media, accessing the internet, from the documents issued as a result of preliminary controls or other investigations, from the activities of cooperation with public or private law bodies or supervisory autorities from other countries, as well as other sources.

(3) The ex officio investigation may be stared in accordance with the conditions provided in article 4 of this procedure.

Article 13 (1) Besides the situations mentioned in article 12, the investigation may also be carried out in order to verify certain dat and information with regard to the processin of personal data, obtained by the NSAPDP from the complaints or notices submitted to the supervisory autority.

(2) Solving the complaints and notices is carried out in accordance with the procedure apporived by the president of the NSAPDP.

Article 14 (1) In the case in which before or during the investigation it is noticed that a file has been filed previously in front of a court of law and refers to the same infringement of the rights of the data subject by the same party, a memo will be issued and submitted to the approval of the presindet of the NSAPDP.

(2) Within the memo mentioned in paragraph (1) explanations will be given with regard to the reasons for which the investigation may not be carried out or through which, as the case may be, proposals are made to stop the investigation, if the incident mentioned in paragraph (1) is noticed after the investigation had been started.

Article 15 (1) The result of the investigation will be recorded within the minute of ascertaining/sanctioning minor offences whose model is provided in annex no. 3 of this procedure, as well as within the report issued in the cases required according to this procedure or whose drafting is required by the president, vicepresident of the NSAPDP or the head of the Investigations' Department.

(2) Within the minute of ascertaining/sanctioning minor offences issued in accordance with the provisions of paragraph (1), the control team must include the following:

a) date and place of issuing the minute of ascertaining/sanctioning minor offences;

b) identification data and positions of the members of the control team, including the number of the control badge;

c) number and date of the empowerment approved by the president of the NSAPDP;

d) object of the control;

e) identification data of the controlled body;

f) identification data and positions of the representatives of the controlled body;

g) findings resulted from the verifications made;

h) description of the minor offence with indication of the date and place of the offence, as well as the legislative act that establishes and sanctions that offence, as well as the sanction applied;

i) the term for exercising an appeal as well as the body competent to handle that request, in the case of applying a sanction for a minor offence;

j) if documents or other material were prelevated, their type and nature;

k) the objections of the representatives of the controlled body who participated at the control activity, as the case may be;

l) mentions on handing over/communication of the minute of ascertaining/sanctioning minor offences, as a copy, to the representatives of the controlled body, in the case of applying sanctions by the persons empowered to do so; in the situation sanctions are applied by the persons empowered to do so, the minute of ascertaining/sanctioning minor offences will also contain mentions on handing over/communication of the notice of payment;

m) the reasons for which the representatives did not sign the minute of ascertaining/sanctioning minor offences, with the indication of the witness that will confirm those reasons, if such a witness exists or the reasons which led to issuing the minute of ascertaining/sanctioning minor offences without a witness.

(3) In the case of applying sanctions by the persons empowered to do so, the control team will fill in the notice of payment, whose model is provided in annex no. 4 of this procedure. The notice of payment will be communicated to the offender and will be posted toghther with the minute of ascertaining/sanctioning minor offences, as the case may be.

(4) The minute of ascertaining/sanctioning minor offences is dated and signed on each page by the members of the control team, the assigned representatives of the controlled body nd, as the case may be, by the witness, within the corresponding points.

(5) If the offender is not present or, although present, cannot or refuses to sign the minute of ascertaining/sanctioning minor offences, its copy, together with the notice of payment, as the case may be, will be communicated by post or by posting at the offende's premises/residence, within a month from the date on which the minute of ascertaining/sanctioning minor offences is issued.

(6) The invsetigations' Department will maintain a record of the minor offence sanctions applied.

Article 16 The control team will transmit to the Legal and Communication Department, in original, the minute of ascertaining/sanctioning minor offences, the notice of payment and documents of their communication, as the case may be, based on a memo assented by the head of the Investigations' Department, in order to begin the procedure of forced execution, according to the law.

Article 17 (1) Following the investigations, the NSAPDP, besides applying the minor offence sanctions, may also dispose compulsory measures meant to stop an infringement of the rights of the data subject, caused by the illegal processing of personal data.

(2) The measures provided in paragraph (1) are disposed by written decisions, grounded and signed by the president of the NSAPDP and may refer to the following:

a) the interdiction to carry out certain data processing;

b) the temporary suspension of certain or all personal data processing operations;

c) stoping the processing of personal data;

d) the partial or total deletion of processed data;

e) noticing the criminal prosecution bodies, in the cases in which it is ascertained that the facts commited by the controlled body constitute the constitutive elements of criminal offences;

f) introducing actions in front of a court of law in order to guarantee the rights granted by law to the data subjects;

g) other accessory measures in order to return to legality;

(3) The measures provided in paragraph (2) are proposed through a report issued by the control team, assented by the head of the Investigations' Department. After approval of the report by the president of the NSAPDP, its copy will be sent to the Legal and Communication Department in order to issue the draft decision.

(4) The signed and approved desions are transmitted to the controlled body within 30 days from the date the complaint is registered, in the case of investigations carried out as a result of complaints and within 30 days from the date the ex officio investigation has been carried out. The Investigations' Department is informed of the transmission of the decision.

(5) The decisions contain provision on the term until which the controlled body must carry out the measures disposed by the president of the NSAPDP.

(6) After the term mentioned in the decision has expired, in case the controlled body didn't prove that it has carried out the measures, a new investigation is carried out in order to verfify the observance of the measures disposed, with the observance of this procedure.

(7) The measures provided in paragraph (2) may be modified, replaced or revoked, as the case may be, only through decision of the president of the NSAPDP, under the conditions of this procedure.

Article 18 Failure to observe the provisions of this procedure may entail disciplinary liability.

CHAPTER III - FINAL AND TRANSITORY DISPOSITIONS

Article 19 Annexes no. 1-5 are integral part of this procedure.

Article 20 The investigations and preliminary controls started prior to the entry into force of this procedure will be carried out with the observance of its provisions.