The National Supervisory Authority finalised an investigation at a natural person and found a violation of the provisions of Article 5 paragraph 1 letters a) and b) and paragraph 2, corroborated with Article 6 paragraph 1, as well as the provisions of Article 13 paragraphs 1-3 and Article 32 paragraph (2) of the General Data Protection Regulation.

The natural person, as controller, was sanctioned with a fine in total amount of Lei 974,89 (the equivalent of Eur 200).

The investigation was started following the receipt of several intimations through which it was claimed that on the website https://declaratieppr.ro, through the filling of a form that can generate a statement on own liability necessary for leaving the house during the state of emergency, some personal data were processed, respectively first name, last name, parents, domicile, personal identification number, series and number of the identity card, address of the de facto residence, place of travel, purpose of travel and signature.

During the investigation the National Supervisory Authority found that the controller did not present proofs from which to result that it has lawfully processed the personal data, collected and stored on the website https://declaratieppr.ro.

Also, it was found that it did not present proofs from which to result that he has ensured the information of the data subject in relation to the processing of their personal data, collected on the same website.

Also, the controller (the natural personal) did not take appropriate security measures to ensure that the file containing the personal data of the data subjects is not subject to some processing risks, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the personal data transmitted, stored or otherwise processed.

A.N.S.P.D.C.P.