The National Supervisory Authority finalised in December 2021 an investigation at the controller Kaufland Romania SCS and found the breach of the provisions of Article 15 paragraph (3) from the General Data Protection Regulation regarding the right of access.

Therefore, the controller was sanctioned with a fine in amount of Lei 14,846.4 (the equivalent of EUR 3,000).

The investigation was started following a complaint submitted by a data subject that claimed that the controller did not provide a full copy of the video recordings for a certain time slot in which the latter was in that commercial premises.

Within the investigation performed, it was noted that the communication of a video recording containing images regarding the data subject is an obligation of the controller, following the exercise of the right of access by the latter and the communication of the images can be performed by the controller by taking the blurring measures of those images that could affect the rights and freedoms of other natural persons, as the case may be. Therefore, the controller shall adopt a series of technical and organisational measures to ensure the full exercise of the data subject’s right of access, with the observance at the same time of the rights of other natural persons.

Therefore, the National Supervisory Authority found that the controller did not fully communicate the video recordings requested, which represents a breach of Article 15 paragraph (3) from the General Data Protection Regulation.

Legal and Communication Department

A.N.S.P.D.C.P.