highlighting the situations presented by the audited entity, the statements of its
representatives and own findings, and applying contravention sanctions or other
types of corrective measures, where applicable; applying a fine if the amount does
not exceed the equivalent in lei of 300,000 euro; applying the remedies prescribed by
the law; elaborating a remediation plan in the situations stipulated by the law;
making the necessary recommendations to remedy the identified deficiencies
where necessary; communicating/handing over to the audited entity a copy of the
verification/sanctioning report.
What is the legal authorization? If the control is in any way prevented, the
NSAPDP may request a legal authorization, a sort of warrant, to the President of
the Bucharest Court of Appeal or to a judge delegated by it. It must be added here
that a copy of the legal authorization must be communicated to the audited entity
before the commencement of the investigation.
As with the Competition Council’s
11 control procedure, NSAPDP inspectors may
hear the people they consider relevant (who could provide clues or more information
about the audit).
According to the GDPR, the sanctions are: the reprimand and the fine. Despite
this fact, in some cases, the NSAPDP may issue also warnings.
If there is a fine of less than 300,000 Euro, the sanction is applied by means of a
verification/sanction report written by the control staff. If there is a fine that exceeds
300,000 Euro, the sanction is applied by means of a decision made by the President
of the National Supervisory Authority, based on the statement and on the report of
the control personnel.
Moreover, the NSAPDP may order, by decision of the President, a penalty
payment of up to 3000 lei for each day of delay, calculated from the date established
by the decision, in case of non-compliance with the corrective measures applied or in
case of tacit or express refusal to supply all information and documents requested in
the investigative procedure or in case of refusal to submit to the investigation,
according to the law. Furthermore, the decision of the president of the NSAPDP is
enforceable.
2.2.2 The Provisions of the Law 506/2004 on Electronic Commerce
This Law establishes the specific conditions for safeguarding the right to privacy
with respect to the processing of personal data in the electronic communications
sector. The provisions of this Law shall apply to the providers of public electronic
communications networks and of publicly available electronic communications
services, as well as to the providers of value added services and of directories of
subscribers who, in the frame of their commercial activity, are processing personal
data. This Law shall not apply to the processing of personal data carried out:
11 The Competition Council, an autonomous body, administers and implements the Competition
Law (No. 21/1996), which aims to protect, maintain and stimulate competition and a normal
competitive environment in order to promote the interests of consumers.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
291
representatives and own findings, and applying contravention sanctions or other
types of corrective measures, where applicable; applying a fine if the amount does
not exceed the equivalent in lei of 300,000 euro; applying the remedies prescribed by
the law; elaborating a remediation plan in the situations stipulated by the law;
making the necessary recommendations to remedy the identified deficiencies
where necessary; communicating/handing over to the audited entity a copy of the
verification/sanctioning report.
What is the legal authorization? If the control is in any way prevented, the
NSAPDP may request a legal authorization, a sort of warrant, to the President of
the Bucharest Court of Appeal or to a judge delegated by it. It must be added here
that a copy of the legal authorization must be communicated to the audited entity
before the commencement of the investigation.
As with the Competition Council’s
11 control procedure, NSAPDP inspectors may
hear the people they consider relevant (who could provide clues or more information
about the audit).
According to the GDPR, the sanctions are: the reprimand and the fine. Despite
this fact, in some cases, the NSAPDP may issue also warnings.
If there is a fine of less than 300,000 Euro, the sanction is applied by means of a
verification/sanction report written by the control staff. If there is a fine that exceeds
300,000 Euro, the sanction is applied by means of a decision made by the President
of the National Supervisory Authority, based on the statement and on the report of
the control personnel.
Moreover, the NSAPDP may order, by decision of the President, a penalty
payment of up to 3000 lei for each day of delay, calculated from the date established
by the decision, in case of non-compliance with the corrective measures applied or in
case of tacit or express refusal to supply all information and documents requested in
the investigative procedure or in case of refusal to submit to the investigation,
according to the law. Furthermore, the decision of the president of the NSAPDP is
enforceable.
2.2.2 The Provisions of the Law 506/2004 on Electronic Commerce
This Law establishes the specific conditions for safeguarding the right to privacy
with respect to the processing of personal data in the electronic communications
sector. The provisions of this Law shall apply to the providers of public electronic
communications networks and of publicly available electronic communications
services, as well as to the providers of value added services and of directories of
subscribers who, in the frame of their commercial activity, are processing personal
data. This Law shall not apply to the processing of personal data carried out:
11 The Competition Council, an autonomous body, administers and implements the Competition
Law (No. 21/1996), which aims to protect, maintain and stimulate competition and a normal
competitive environment in order to promote the interests of consumers.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
291