The National Supervisory Authority finalized in November 2022 an investigation at the controller Autoritatea Națională pentru Restituirea Proprietăților (ANRP) and found the breach of the provisions of Article 14 paragraph (7) corroborated with Article 14 paragraph (1) and Article 13 paragraph (4) of Law no. 190/2018.

The controller was sanctioned with fine in amount of Lei 13,000.

The investigation was started for the verification of the fulfilment by ANRP of the remedy measures previously taken against this controller through a findings/sanctioning report from September 2022.

In this context, through the previous report, the ANRP controller was sanctioned with reprimand for the breach of the provisions of Article 5 paragraph (1) letter b) and Article 6 of the GDPR, being also obliged through the remedy plan to ensure, within the 20 days’ deadline, the observance of the personal data processing operations with the GDPR provisions, including of those performed through the video surveillance system, through the implementation of technical and organisational measures, following the evaluation on the risk for the persons’ rights and freedoms (for example working procedures on the protection of personal data, as well as measures for the regular training of the persons acting under its authority, regarding the obligations incumbent on them according to the GDPR and the risks that the personal data processing involves, depending on the specific of the activity).

Given that the controller did not communicate the measures taken, in November 2022, a new investigation was performed at ANRP in relation to the fulfilment of the measures provided within the remediation plan annex to the findings report from September 2022. Within it, the representatives of the controller declared that documents such as “Video surveillance regulation 2022” or “the System procedure on the personal data processing” have not been approved and therefore not brough to the knowledge of the personnel from the ANRP subordination that processes data. Also, the representatives of the controller argued that regular training of the persons acting under the ANRP authority did not taken place.

Therefore, it was found that the controller ANRP did not fulfil the measures provided within the measures plan established by ANSPDCP, thus breaching the provisions of Article 14 paragraph (7) in conjunction with Article 14 paragraph (1) and Article 13 paragraph (4) of Law no. 190/2018.

In this context, we draw the attention that, within the implementation of Law no. 190/2018, reprimands and remediation plans can be applied to the public authorities. If these do not fully implement the measures provided under the remediation plan, ANSPDCP can apply the fine.

The controller Autoritatea Națională pentru Restituirea Proprietăților (ANRP) has paid the fine.

Legal and Communication Department

A.N.S.P.D.C.P.