Any citizen, in his capacity as data subject, can file a
complaint with ANSPDCP if he considers that the processing of his personal data
is done in violation of the law by an operator / authorized person. The citizen
must have his usual residence or dwelling or work place on the territory of
Romania or at least the violation must have taken place on this territory.
The legal framework regarding the procedure for receiving
and resolving complaints is regulated by Decision no. 133/2018 of ANSPDCP,
published in the Official Gazette. no. 600 / 13.07.2018.
I. Conditions for submitting a complaint to the ANSPDCP
Complaints submitted by data subjects to the ANSPDCP must
meet a number of conditions, namely:
1. to be formulated in writing, in Romanian or in English,
in compliance with the conditions provided by GDPR;
2. be sent by post, e-mail or by using the electronic form,
available on the official website of ANSPDCP (noting that there are situations
in which some fields in the form have become problematic for the persons
concerned in the sense that they did not allow the completion their);
3. may be submitted in person or by proxy (the person's
agent may be a spouse or relative up to and including the second degree, in
which case a declaration on his / her own responsibility signed by the
petitioner is attached, and in the case of other persons the notarial power of
attorney is attached);
4. where the complaint is lodged through a non-profit body,
organization or association or foundation, they must prove that: they have been
legally constituted and are active in the field of protection of the rights and
freedoms of data subjects with regard to protection of their personal data;
5. the complaint must contain at least the following
identification data of the petitioner: name, surname, postal address of
domicile or residence (and if the complaint is sent by e-mail, and the e-mail
address of the petitioner). If the complaint does not contain the
identification data of the petitioner ANSPDCP will file it;
6. when the complaint is sent through the representative,
the following data will be provided: name and surname / name, postal address /
headquarters, e-mail address, telephone number, registration number in the
register of associations and foundations, if any applicable;
7. all the information that the petitioner knows and that
serves to identify the operator or the authorized person who is guilty of the alleged
violation, respectively: name and surname / name, address / registered office,
etc .;
8. contain the handwritten or electronic signature of the
data subject;
9. must refer to the steps already taken by the petitioner
with the requested operator or proxy;
10. contain or have attached conclusive evidence of a breach
of the provisions on the processing of personal data (if the petitioner has
evidence);
11. Infringements may involve, for example: failure to take
appropriate organizational or security measures by the controller / authorized
person regarding the processing of the petitioner's personal data; the fact
that the latter was not provided with any response to a request (by which he
exercised his specific rights as a data subject) or was provided with an
incomplete response or in violation of the mandatory term (one month,
respectively 2 months), etc.
12. to specify whether other steps have been taken, such as
the bringing before the courts of an action with the same object and with the
same operator or authorized person (in this case ANSPDCP having the right to
order the suspension and / or filing of the complaint, in depending on the
specific data of the case);
13. for the violation of the right to privacy, family and
private life in the field of electronic communications and electronic commerce,
it is mandatory for the petitioner to specify '' telephone or fax number (s),
e-mail address (es) or IP address (es) which are related to the subject of the
complaint '';
14. for infringements concerning the “violation of the right
to privacy, family and private life by the transmission of unsolicited
commercial communications, by electronic communications services intended for
the public, it is mandatory to attach the original messages received by the
petitioner by a method to identify to the sender of that communication,
messages which must be preserved, as far as possible, in the electronic system
used by the petitioner. ''
II. The procedure for receiving and resolving complaints
The data subjects who lodge complaints with the ANSPDCP may
request that certain personal data provided by them in the complaint be kept
confidential, except where the identification data of the petitioner must
necessarily be disclosed.
No comments:
Post a Comment