THE 4th FINE FOR THE APPLICATION OF GDPR
In July 2019, the National Supervisory Authority finalised an investigation at data controller UTTIS INDUSTRIES SRL and found out that it infringed the provisions of Article 12 and Article 5 (1) letter c) in conjunction with Article 6 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
The data controller UTTIS INDUSTRIES SRL was sanctioned with a fine of 11834.25 lei, the equivalent of 2500 Euros.
Thus, it was applied:
- a fine of 4733.70 lei (the equivalent of 1000 Euros) for the infringement of provisions of Article 12 of GDPR and;
- a fine of 7100.55 lei (the equivalent of 1500 Euros) for the infringement of provisions of Article 5 (1) letter c) in conjunction with Article 6 of GDPR.
The sanctions were applied to the data controller because:
- could not prove that the data subjects were informed about the processing of personal data / images through the video surveillance system, which they have been doing since 2016;
- it disclosed the personal identification number of the employees, by displaying the Report for the training of the ISCIR authorised personnel related to the year 2018 on the company’ notice board and could not prove the legality of the processing of personal identification number, by disclosure, according to Article 6 of GDPR.
The National Supervisory Authority applied the sanction as a result of intimations dated the 21st of March 2019, which indicated that UTTIS INDUSTRIES SRL has video surveillance cameras installed, without carrying out the legal information regarding the video surveillance, as well as the fact that it disclosed illegally the name and the personal identification number of the employees, by displaying these personal data on the notice board of the company.
Pursuant to Article 12 of GDPR, the data controller had the obligation to implement adequate measures in order to provide the data subject any information stipulated by Articles 13 and 14.
Legal and Communication Department
A.N.S.P.D.C.P.
