Credit Bureau Data Deletion Procedure in Romania
The deletion of recorded data at the Credit Bureau can be carried out either automatically or upon the request of the concerned individual, depending on the situation.
If the legal storage period expires, the data is automatically removed from the Credit Bureau’s database. This operation does not require any action from the registered individual, as it is automatically performed by the institution’s information system. Generally, unless other legal provisions apply, data is automatically deleted after 4 years.
When data has been processed in violation of legal provisions, the concerned individual has the right to request its deletion. In this case, the request must be submitted to the financial institution that transmitted the information to the Credit Bureau. The applicant must provide arguments demonstrating that data processing was carried out in violation of the applicable legal norms.
The recording of this data must comply with the provisions of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data, which states that:“Processing shall be lawful only if and to the extent that at least one of the following conditions applies:
(a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary to protect the vital interests of the data subject or another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a child.”
Additionally, in certain cases, legislation may impose an obligation on the Credit Bureau or its participants to delete recorded data. In such situations, deletion is carried out in accordance with applicable legal provisions, without requiring a request from the concerned individual.
To initiate the data deletion procedure at the Credit Bureau, the interested person has multiple options. One option is to access the Credit Bureau’s website and submit an electronic request. Alternatively, the request can be made in person at the financial institution that acts as the creditor or potential creditor of the concerned individual.
To exercise the right to data deletion in Romania, the concerned individual must provide a series of details and documents. These include identification data (name, surname, personal identification number), a copy of the identity document, and a signed statement confirming the request for data deletion.
The financial institution or the Credit Bureau will analyze the received request and verify the validity of the arguments presented. If it is determined that the request is justified and that there are legal grounds for data deletion, the data will be removed from the Credit Bureau’s database.
It is important to note that data deletion from the Credit Bureau does not automatically imply its removal from the internal records of the financial institution that granted the credit. Each financial institution retains its own records in accordance with internal policies and regulations.
If the deletion request is denied, the concerned individual has the right to contest this decision. The appeal can be submitted to the financial institution that refused the request or, if no satisfactory resolution is reached, to the National Authority for the Supervision of Personal Data Processing, which, according to Law 102/2005, has supervisory authority over personal data processing.
How long does it take to be removed from the Credit Bureau in Romania?
The duration of the data deletion procedure from the Credit Bureau varies depending on the method of execution and the complexity of the case.
If deletion occurs automatically at the expiration of the legal storage period, it is carried out instantly without delays. The Credit Bureau’s system is programmed to remove such data as soon as the legal retention period expires.
When deletion is requested by the concerned individual, the entire process takes longer. In general, financial institutions and the Credit Bureau have a deadline of 30 calendar days to respond to requests for the exercise of data subjects’ rights, including the right to data deletion.
In exceptional cases, where the request is particularly complex or when multiple requests are received simultaneously, this period may be extended by another 60 days.
In practice, the actual duration of the deletion process in Romania may vary based on several factors, including:
- The completeness and accuracy of the information provided by the applicant
- The complexity of the legal situation of the concerned individual
- The volume of data to be verified and potentially deleted
- The necessity of further investigations to determine the validity of the request
- The workload of the department responsible for handling such requests.
If the deletion request is approved, the actual removal of data from the Credit Bureau’s system is generally carried out within a few business days after the decision is communicated to the concerned individual.
It is important to emphasize that, although data deletion from the Credit Bureau can be completed within a relatively short period, the effects of this action on the individual’s credit score may take longer to materialize. Financial institutions periodically update their information regarding their clients, and changes in the Credit Bureau database may only be reflected in future credit evaluations.
If the deletion request is denied and the concerned individual decides to contest the decision, the procedure may be significantly prolonged. Resolving a complaint may require additional investigations and, in some cases, involve the intervention of the National Authority for the Supervision of Personal Data Processing.
