05.07.2023

ANPC Prohibition – Body Cam

The National Supervisory Authority for Personal Data Processing finalized during June 2023 an investigation at the controller the National Authority for Consumers’ Protection and found the breach of the provisions of Article 5 letter a), in conjunction with Article 6 paragraph (1) from Regulation (EU) 2016/679.

ANPC was sanctioned with reprimand according to the provisions of Law no. 190/2018.

The sanction was applied following the performance of an investigation started following some intimations regarding the fact that the controller ANPC is breaching the personal data legislation by using body-worn type devices “given to the commissioners with control attribution in order to use them within the control actions” and that “for more than 6 months the commissioners from ANPC are recording the controls and surprise in these images, without any consent and without any supervision, not only colleagues, employees or representatives of some economic operators, but also many private persons, children or adults, in stores, at pools, in restaurant, at the bar or saloon”.

Within the investigation performed it was found that ANPC is processing the personal data collected through body-cam type devices (first name and last name, capacity/position, image, voice and behavior), starting with May 2023, for the purpose of the preconstitution of evidence in relation to the control actions.

The controller was not able to prove the fact that the processing performed with Body Camera means has a legal basis within the internal law applicable. The existence of a specific legal provision to provide the use of the BodyCam portable cameras, with audio-video recording function, within the ANPC activity, by reference to its specific tasks.

Therefore, it was found that the processing of the personal data (first name, last name, position/capacity, image, voice, behavior) through the audio-video portable surveillance system was performed without for a legal obligation of the controller to exist, without for the processing to be performed for the execution of a task that serves to a public interest or is part of the exercise of the public authority and without the fulfilment of any other conditions provided under Article 6 paragraph (!) corroborated with paragraph (3) from the GDPR. According to Article 5 paragraph (1) paragraph (1) from the GDPR, the controller had the obligation to process the data legally, fair and transparent in relation to the data subject.

In addition to the reprimand sanction, the National Supervisory Authority for Personal Data Processing also applied a corrective measure, ordering to the controller ANPC to cease any operation or set of operations for the processing of personal data performed through the BodyCam portable devices with audio-video recording function and to delete the personal data from the evidence system created following the use of such devices.

The controller National Authority for Consumers’ Protection informed the National Supervisory Authority for Personal Data Processing that it executed the measure ordered.

In this context regarding the use of bodycams by public authorities, we mention that following the investigations performed by ANSPDCP, it was found that controllers such as Cluj UAT (Local Police), Constanta UAT (Local Police) and Bucharest District 4 Hall (Local Police) breached the provisions of Article 5 paragraph (1) letter a) by reference to Article 6 paragraph (1) from Regulation (EU) 2016/679, given that the personnel of the Local Police, during the exercise of the specific missions and activities, processed personal data by using the portable audio-video BodyCam system (image and voice) without for a legal obligation of the controller to exist and without the fulfillment of other condition provided under Article 6 paragraph (1) from the GDPR.

Also, we highlight that through final decisions from 2022 and 2023, the judicial courts maintained the decisions of ANSPDCP through which the cease of the processing and the erasure of the images collected by the local police was ordered, following the controls through which the lack of legality of those data processing (within the litigations with UAT Cluj – Local Police and UAT Constanta – Local Police).

Thus, the Constanta Court of Appeal stated, among others, within the decision rendered in the case of UAT Constanta with ANSPDCP that: “the decision represents the act through which are established and applied the specific corrective measures, in this case, for the erasure of the data, according to the provisions of Article 16 paragraph (6) from Law no. 102/2005, being issued based on the deeds and circumstances found through thee contravention report (…), act through which the breach of the law and the obligation to the fulfillment of the remedy measures established through the remedy plan attached to the contravention report”.

At the same time, the Bucharest Court of Appeal within the litigation with UAT Cluj, decided that “(…) the authority defendant found the breach of the Regulation (EU) 2016/679, given that the personnel of the General Direction of the Local Police Cluj-Napoca, during the exercise of the missions and specific activities, processed personal data by using the portable BodyCam audio-video system (image and voice) starting with October 2019, without for a legal obligation of the controller to exist and without the fulfilment of another condition provided under Article 6 paragraph (1) from the GDPR, although according to Article 5 paragraph (1) letter a) from the GDPR, the controller had the obligation to process the data lawfully, fairly and in a transparent manner in relation to the data subject.

Therefore, through the Decision challenged it was ordered to the plaintiff to cease any operation of set of operations for the processing of personal data performed through the BodyCam audio-video system and to erase the evidence system of the personal data created following the use of such systems.”

Legal and Communication Department

A.N.S.P.D.C.P.