Europeiska dataskyddsstyrelsen

Romanian Supervisory Authority sanction on data controller UTTIS INDUSTRIES SRL

Monday, 1 July, 2019
ro

In July 2019, the National Supervisory Authority finalised an investigation at data controller UTTIS INDUSTRIES SRL and found out that it infringed the provisions of Article 12 and Article 5 (1) letter c) in conjunction with Article 6 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The data controller UTTIS INDUSTRIES SRL was sanctioned with a fine of 11834.25 lei, the equivalent of 2500 Euros.

Thus, it was applied:
a fine of 4733.70 lei (the equivalent of 1000 Euros) for the infringement of provisions of Article 12 of GDPR and;
a fine of 7100.55 lei (the equivalent of 1500 Euros) for the infringement of provisions of Article 5 (1) letter c) in conjunction with Article 6 of GDPR.
The sanctions were applied to the data controller because:
could not prove that the data subjects were informed about the processing of personal data / images through the video surveillance system, which they have been doing since 2016;
it disclosed the personal identification number of the employees, by displaying the Report for the training of the ISCIR authorised personnel related to the year 2018 on the company’ notice board and could not prove the legality of the processing of personal identification number, by disclosure, according to Article 6 of GDPR.
The National Supervisory Authority applied the sanction as a result of intimations dated the 21st of March 2019, which indicated that UTTIS INDUSTRIES SRL has video surveillance cameras installed, without carrying out the legal information regarding the video surveillance, as well as the fact that it disclosed illegally the name and the personal identification number of the employees, by displaying these personal data on the notice board of the company.
Pursuant to Article 12 of GDPR, the data controller had the obligation to implement adequate measures in order to provide the data subject any information stipulated by Articles 13 and 14.

To read the press release in Romanian, click here
For further information, please contact the Romanian Supervisory Authority: anspdcp@dataprotection.ro

The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.