01/04/2021

The submission of complaints with ANSPDCP

The General Data protection Regulation (EU) 2016/679 establishes a unique set of rules dedicated to the efficient protection of privacy of the natural persons on the European Union’s territory.

The General Data Protection Regulation grants to the natural persons several rights, respectively:

• rights of access (Article 15);
• right to rectification (Article 16);
• right to erasure (“right to be forgotten” – Article 17);
• right to restriction of processing (Article 18);
• right to data portability (Article 20);
• right to object (Article 21);
• right not to be subject to a decision based solely on automated processing (Article 22).

In order to exercise these rights the natural person shall send a request to the controller that processed his/her personal data.

The controller shall respond to that person within maximum 1 month from the receipt of the request and, in case it does not intend to respond to that request, to justify this refuse. This response period can be extended with two months when it is necessary, taking into account the complexity and number of requests. In this case, the controller shall inform the data subject in relation to any such extension, within one month from the receipt of the request, also presenting the reasons for the delay.

In case the data subject:

• is not satisfied with the manner of settlement of the request or
• he/she did not receive a response from the controller,
• he/she has the possibility to submit a complaint with the National Supervisory Authority.

The complaints to the National Supervisory Authority can be submitted by any data subject that considers that the manner of processing of his/her personal data is breaching the legal provisions in force, in particular in case his/her usual residence, work place or alleged breach is or, as the case may be, takes place on Romania’s territory.

The complaint is submitted personally or through representative (with the attachment of the power-of-attorney issued according to the law by an attorney or a notarized power-of-attorney, as the case may be).

The complaint can also be submitted by the representative of the data subject, who is a spouse or relative up to second degree inclusively, according to Article 3 of the Decision no. 133/2008 regarding the approval of the procedure for the receipt and handling of complaints.

The complaints shall be made in writing, in Romanian or English.

The complaints can be submitted at the general registry at ANSPDCP’s headquarters or can be sent by post, including electronic post, or by using the electronic form available on the ANSPDCP’s website, under section Complaints https://www.dataprotection.ro/?page=Plangeri_RGPD&lang=ro.

According to the Decision of the President of the National Supervisory Authority no. 133/2018, when submitting the complaints it is mandatory:

• the detailed description of their subject matter;
• the mention of the steps taken by the complainant (data subject) in relation to the complainant controller or processor;
• the mention of the information available in support of the affirmations;
• the submission of the conclusive proofs, in case he/she has them.

For the receipt and valid registration of the complaint it is mandatory:

• to submit the following data of the complainant: first name, last name, postal domicile or residence address; in case the complaint is submitted electronically, the provision of the electronic e-mail address of the complainant;
• the provision of the identification data of the controller or processor, such as first name and last name/name, address/headquarters or at least the available information held by the complainant, in order to identify it;
• for the complaints submitted through representative, the provision of the following data of the representative: first name and last name/name, postal address of correspondence/headquarters, e-mail address, telephone number, registration number in the register of associations and foundations, if applicable.

The submitted complaints shall be signed by handwriting or by electronic means, and, in the case of electronically submitted petitions can not be signed, ANSPDCP may request the confirmation of the correctness of the data transmitted electronically.

The petitioners may request the confidentiality of certain expressly mentioned personal data provided through the complaint, except for the cases where, for the proper handling of the subject matter of the complaints submitted, the petitioner’s identification data must be disclosed to the complainant entity.

The National Supervisory Authority notifies the petitioner in writing, within maximum 45 days from registration, that the complaint is admissible, according to the provisions of Article 9 from Decision no. 133/2018.

If it is found that the information in the complaint or the documents submitted are incomplete or insufficient, ANSPDCP requires the data subject to complete the complaint in order for it to be considered admissible in order to conduct an investigation. A new deadline of maximum 45 days shall run from the date of completion of the complaint.

The National Supervisory Authority shall inform the data subject about the progress or result of the investigation within three months from the date when it was communicated that the complaint is admissible.

In case a more detailed investigation or coordination with other supervisory authorities is necessary, the National Supervision Authority shall inform the data subject about the progress of the investigation, every three months, until it is finalised.

The complaint that does not specify the identification data of the petitioner (name, surname, postal address of domicile or residence or electronic address) is considered anonymous and is classified, without any reply to the petitioner, according to the provisions of Article 10 from Decision no. 133/2018.

The procedure for the receipt and handling of the complaints is regulated through Decision of the President of the National Supervisory Authority no. 133/2018, published within the Official Journal no. 600 from the 13^th of July 2018, available on the website of the Authority www.dataprotection.ro, under section Legislation/ANSPDCP Decisions at the website:

https://www.dataprotection.ro/servlet/ViewDocument?id=1517

The online complaint form is available at the adress https://www.dataprotection.ro/formulare/formularPlangere.do?action=view_action&newFormular=true

Legal and Communication Department

ANSPDCP