GDPR is short for General Data Protection Regulation which translates to General Data Protection Regulation. It is an official act of the European Union (EU Regulation 679/2016) which aims to ensure the protection of fundamental human rights in the context of the transfer and processing of personal data of individuals. Specifically, the provisions of the Regulation apply in situations where, for certain activities, individuals are required to provide an institution, a legal entity or another natural person with certain personal data (name, surname, address, date of birth and the like).
Processing of personal data means any operation relating to these data. Therefore, the collection, storage, adaptation, adaptation, alteration or deletion of such data, as well as other operations provided for by law, fall within the scope of the GDPR Regulation.
There is a category of personal data which is sensitive. Such data are those relating to: race, ethnicity, religious and political convictions, a person’s sex life, state of health, genetic and biometric data processed for the purpose of identifying a person.
In principle, the processing of such data is prohibited, but it is allowed in certain situations. Such situations are those where the data subject has given his or her consent to the processing of these data, where the processing of these data is absolutely necessary to protect the rights and vital interests of the data subject, his or her social security in the employment context. Such data may also be processed by non-profit foundations and organizations or where such data have already been made public by the data subject.
With regard to the processing of personal data, controllers are obliged to inform the persons whose data are processed about who is processing these data and in what capacity, for what purpose, to whom they are to be disclosed and why, as well as the contact details of the data controller.
There are certain situations where the Regulation does not apply. These are, in the first place, situations where certain activities are in no way related to the objectives of the European Union and which are also not subject to Union law rules. Nor do the provisions of the GDPR Regulation apply to activities relating to the pursuit, prevention or punishment of certain criminal offenses in investigations carried out by state bodies. Last but not least, the provisions of the GDPR do not apply to situations between private individuals that are strictly related to the way they organize their private life, such as in the case of domestic activities.
GDPR – LAW IN ROMANIA
In Romania, the provisions of EU Regulation 679/2016 have been transposed into national law by Law 190/2018 on measures implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
It provides for some derogations, i.e. some situations where the provisions of the Regulation, or part of them, do not apply. Thus, in the case of artistic, literary, academic or journalistic works, any information that is already made known to the general public by the data subject may be used. The processing of personal data for scientific or historical research purposes, for statistical purposes or for archiving purposes in the public interest derogates from the general regime under certain conditions, in the sense that not all the provisions of the Regulation apply to them, but only some of them.
According to the EU Regulation and Law 190/2018, each controller must appoint a data protection officer for the protection of the processed data. This person has the obligation to monitor all data processing activity, to ensure that this activity is carried out in accordance with the relevant legal provisions and also to advise the controller on any operation involving the processing of personal data.
BREACH OF GDPR IN ROMANIA
A GDPR breach occurs when, accidentally or unlawfully, the personal data of individuals, firms or companies of any kind are no longer protected, and there is a risk that their confidentiality may be breached. In such situations, controllers responsible for processing such data must notify the supervisory authority no later than 72 hours after the incident has been detected. In so far as no prompt and effective measures have been taken to eliminate the risks, operators must notify their customers of such a situation.
Anyone who observes or believes that their personal data privacy rights have been violated can complain to the DPA (Data Protection Authority). In this case, if the complaint is not resolved in the correct manner, legal action may be taken against the authority. Also, if your data has been breached and you know who is responsible for it (for example, you have a digital watch that records physical activity and you find that your information has been mixed up or mixed with another person’s data) you can take legal action directly against the controller responsible for the incident. In these cases, the court will settle the case and order the necessary measures.
The last chapter of Law 190/2018 lays down the sanctions applicable to operators who fail to comply with data protection provisions. These sanctions therefore apply in situations where operators are at fault for any breach of data security and confidentiality. According to the provisions of the Act, the breach of obligations by the controller or the controller’s designated officer, as well as the violation of the principles of the Regulation and of the rights of any person, constitute a contravention. The main sanctions are a warning and a fine.
In the case of public authorities and public bodies, the National Supervisory Authority draws up a statement of offense establishing and sanctioning the contravention. Failure to comply with its decisions also constitutes a contravention.
