The National Supervisory Authority finalised in March 2023 an investigation at the controller Regency Company SRL and found the breach of the provisions of Article 5 paragraph 1 letters a), b) and c) by reference to article 6 from Regulation EU 2016/679.

Therefore, the controller was sanctioned with fine in amount of Lei 14,764.2 (the equivalent of Eur 3,000).

The investigation was started following an intimation submitted by a natural person that reported a possible breach of the provisions of Regulation EU 2016/679.

Thus, it was reported that the employees and collaborators of the company Regency Company SRL are audio/video monitored at the workplace, without their consent.

Within the investigation performed it was found that the controller, through the video surveillance system installed in offices and coffee room, processed personal data with the breach of the processing principles, in lack of a legal processing basis that would justify such an intrusion in the private life of the employees.

At the same time, it was found that the controller processed personal data of its employees (image) excessively, through this video surveillance system, the purposes declared by the controller (monitoring of the persons' access, ensuring the security of spaces and goods, the safety of persons) being able to be achieved through less intrusive means for the private life of the employees.

Based on article 58 paragraph 2 letter d) from Regulation EU 2016/679, it was ordered to the controller also the corrective measures consisting of removing the use of video surveillance cameras installed in the office and coffee room, for which there is no specific legal basis for the processing of the personal data of its own employees, according to article 6 from the GDPR.

Legal and Communication Department

A.N.S.P.D.C.P.