The law defines the following: national identification number—the number by
which a natural person is identified in certain record systems and which is of general
applicability, such as: the personal identification code, the ID series and number, the
passport number, the driving license number, the social security number.
Thus, almost any number that helps to officially identify an individual is a
national identification number.
The task that serves the public interest is defined by this law as including those
activities of political parties or of organizations of citizens belonging to national
minorities, of non-governmental organizations, which serve the achievement of
objectives provided by constitutional law or by international public law, or the
functioning of the democratic system, including encouraging citizens to participate
in the decision-making process and in the preparation of public policies, respectively
promoting the principles and values of democracy.
Public authorities/bodies are advantaged by the new law and in addition they have
90 days at their disposal from the date of communication of the official report of the
contravention, to remedy the detected irregularities and to fulfil their legal
obligations.
By far the most heated discussions with regards to the new law have been
generated by processing personal social numbers (CNPs) or ID data.
Grounds for processing personal data according to GDPR: consent, concluding or
executing a contract, fulfilling a legal obligation, vital interests, public interest,
legitimate interest.
If the operator chooses to process based on legitimate reason, it is necessary to
appoint a DPO (Data Protection Officer). We hereby quote the law provision in order
to avoid confusion:
Art.4 – (1) The processing of a national identification number, including by collecting or
disclosing documents containing it, can be made in the situations provided by Art. 6 paragraph (1) of the General Data Protection Regulation.
(2) The processing of a national identification number, including by collecting or disclosing
documents containing it,
the purpose of Article 6 ( 1) ( f) of the General Data Protection Regulation, namely the
achievement of legitimate interests pursued by the operator or a third party, shall be the
establishment by the operator of the following safeguards:
For the purposes provided by Art. 6 par. (1), item f) of the General Data Protection
Regulation, namely achieving the legitimate interests followed by controller or by a third
party, safeguards shall be made provided that the controller institutes the following:
b) Appointing a data protection representative, in compliance with the provisions of Art.
10 of the present law;
c) Setting out storage limitation periods, according to the nature of the data and the
processing purpose, as well as specific periods when personal data need to be deleted or
revised for deletion purposes;
d) Periodical training regarding the obligations of the persons processing personal data,
under the direct authority of the controller or the processor.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
293
which a natural person is identified in certain record systems and which is of general
applicability, such as: the personal identification code, the ID series and number, the
passport number, the driving license number, the social security number.
Thus, almost any number that helps to officially identify an individual is a
national identification number.
The task that serves the public interest is defined by this law as including those
activities of political parties or of organizations of citizens belonging to national
minorities, of non-governmental organizations, which serve the achievement of
objectives provided by constitutional law or by international public law, or the
functioning of the democratic system, including encouraging citizens to participate
in the decision-making process and in the preparation of public policies, respectively
promoting the principles and values of democracy.
Public authorities/bodies are advantaged by the new law and in addition they have
90 days at their disposal from the date of communication of the official report of the
contravention, to remedy the detected irregularities and to fulfil their legal
obligations.
By far the most heated discussions with regards to the new law have been
generated by processing personal social numbers (CNPs) or ID data.
Grounds for processing personal data according to GDPR: consent, concluding or
executing a contract, fulfilling a legal obligation, vital interests, public interest,
legitimate interest.
If the operator chooses to process based on legitimate reason, it is necessary to
appoint a DPO (Data Protection Officer). We hereby quote the law provision in order
to avoid confusion:
Art.4 – (1) The processing of a national identification number, including by collecting or
disclosing documents containing it, can be made in the situations provided by Art. 6 paragraph (1) of the General Data Protection Regulation.
(2) The processing of a national identification number, including by collecting or disclosing
documents containing it,
the purpose of Article 6 ( 1) ( f) of the General Data Protection Regulation, namely the
achievement of legitimate interests pursued by the operator or a third party, shall be the
establishment by the operator of the following safeguards:
For the purposes provided by Art. 6 par. (1), item f) of the General Data Protection
Regulation, namely achieving the legitimate interests followed by controller or by a third
party, safeguards shall be made provided that the controller institutes the following:
b) Appointing a data protection representative, in compliance with the provisions of Art.
10 of the present law;
c) Setting out storage limitation periods, according to the nature of the data and the
processing purpose, as well as specific periods when personal data need to be deleted or
revised for deletion purposes;
d) Periodical training regarding the obligations of the persons processing personal data,
under the direct authority of the controller or the processor.
Data Protection Regulations: Overview of the Romanian Legislation and. . .
293