The National Center for Personal Data Protection, for information and application purposes, communicates about a series of fines applied by Romanian National Supervisory Authority for Personal Data Processing for violating the provisions of General Data Protection Regulation (GDPR).

–  An economic agent was fined with 15 000 EUR for violating the security of personal data. On the Facebook page on which the controller conducted an online contest to attract customers participating in the car service, was posted a document with a screenshot of the source code of the website which included the access password to the forms completed by the contest participants.

This situation created the possibility of viewing and unauthorized access to personal data of a number of 436 customers of the controller, through its website and the unauthorized disclosure of such data, contrary to the provisions of art. 32 of  GDPR.

–    At the same time, a banking institution was fined with 5 000 EUR for collecting copies of customers’ ID card through an employee’s personal phone.

The investigation was initiated following a complaint and during its conduct, the Romanian National Supervisory Authority for Personal Data Processing found that the banking institution did not implement technical and organizational measures to ensure an adequate level of security appropriate to the risk of processing. The controller did not take steps to ensure that any natural person acting under his authority who has access to personal data does not process them except on instructions from the controller, unless this obligation is required by Union or Member State law.

Moreover, the banking institution should have implemented some technical measures so as to ensure the confidentiality of personal data and strictly authorized access to data transmitted by its customers.

The non-compliance with the requirements aforementioned, has led to the infringement of GDPR and the sanctioning of the controller concerned with 5 000 EUR.

Statements adopted by European Data Protection Board

During the Plenary Session of the European Data Protection Board, held online on 16 June 2020, the following documents were adopted:
•        Statement on the data protection impact of the interoperability of contact tracing apps;
The Statement emphasizes the need to respect the transparency and legal basis of the processing involved, data subject rights, principles of data minimization and personal data confidentiality. Furthermore, the goal of interoperability should not be used as an argument to extend the collection of personal data beyond what is necessary.

•        Statement on the processing of personal data in the context of reopening of borders following the COVID-19 outbreak.
The statement specifies the measures allowing a safe reopening of the borders currently envisaged or implemented by Member States include testing for COVID-19, requiring certificates issued by health professionals and the use of a voluntary contact tracing app. At the same time, the EDPB urges the Member States to take a common European approach when deciding which processing of personal data is necessary in this context.