Tuesday, August 4, 2020

The procedure for submitting a complaint to ANSPDCP regarding the processing of personal data

Any citizen, in his capacity as data subject, can file a complaint with ANSPDCP if he considers that the processing of his personal data is done in violation of the law by an operator / authorized person. The citizen must have his usual residence or dwelling or work place on the territory of Romania or at least the violation must have taken place on this territory.

The legal framework regarding the procedure for receiving and resolving complaints is regulated by Decision no. 133/2018 of ANSPDCP, published in the Official Gazette. no. 600 / 13.07.2018.

I. Conditions for submitting a complaint to the ANSPDCP

Complaints submitted by data subjects to the ANSPDCP must meet a number of conditions, namely:

1. to be formulated in writing, in Romanian or in English, in compliance with the conditions provided by GDPR;

2. be sent by post, e-mail or by using the electronic form, available on the official website of ANSPDCP (noting that there are situations in which some fields in the form have become problematic for the persons concerned in the sense that they did not allow the completion their);

3. may be submitted in person or by proxy (the person's agent may be a spouse or relative up to and including the second degree, in which case a declaration on his / her own responsibility signed by the petitioner is attached, and in the case of other persons the notarial power of attorney is attached);

4. where the complaint is lodged through a non-profit body, organization or association or foundation, they must prove that: they have been legally constituted and are active in the field of protection of the rights and freedoms of data subjects with regard to protection of their personal data;

5. the complaint must contain at least the following identification data of the petitioner: name, surname, postal address of domicile or residence (and if the complaint is sent by e-mail, and the e-mail address of the petitioner). If the complaint does not contain the identification data of the petitioner ANSPDCP will file it;

6. when the complaint is sent through the representative, the following data will be provided: name and surname / name, postal address / headquarters, e-mail address, telephone number, registration number in the register of associations and foundations, if any applicable;

7. all the information that the petitioner knows and that serves to identify the operator or the authorized person who is guilty of the alleged violation, respectively: name and surname / name, address / registered office, etc .;

8. contain the handwritten or electronic signature of the data subject;

9. must refer to the steps already taken by the petitioner with the requested operator or proxy;

10. contain or have attached conclusive evidence of a breach of the provisions on the processing of personal data (if the petitioner has evidence);

11. Infringements may involve, for example: failure to take appropriate organizational or security measures by the controller / authorized person regarding the processing of the petitioner's personal data; the fact that the latter was not provided with any response to a request (by which he exercised his specific rights as a data subject) or was provided with an incomplete response or in violation of the mandatory term (one month, respectively 2 months), etc.

12. to specify whether other steps have been taken, such as the bringing before the courts of an action with the same object and with the same operator or authorized person (in this case ANSPDCP having the right to order the suspension and / or filing of the complaint, in depending on the specific data of the case);

13. for the violation of the right to privacy, family and private life in the field of electronic communications and electronic commerce, it is mandatory for the petitioner to specify '' telephone or fax number (s), e-mail address (es) or IP address (es) which are related to the subject of the complaint '';

14. for infringements concerning the “violation of the right to privacy, family and private life by the transmission of unsolicited commercial communications, by electronic communications services intended for the public, it is mandatory to attach the original messages received by the petitioner by a method to identify to the sender of that communication, messages which must be preserved, as far as possible, in the electronic system used by the petitioner. ''

II. The procedure for receiving and resolving complaints

The data subjects who lodge complaints with the ANSPDCP may request that certain personal data provided by them in the complaint be kept confidential, except where the identification data of the petitioner must necessarily be disclosed.