When addressing the issue of legitimate interest, if we do not have a legal
obligation (provided by the law in a broad sense, such as law, decision, ordinance,
local council decision etc.), we will have to follow the other legal bases mentioned
above.
For example, displaying the CNP on tax invoices or in the “customer” or
“representative” field may fall into another legal category than the legitimate interest,
so appointing a DPO will be necessary. This is not the case though when we ask an
employee for the CNP to write up the employment contract, as this is an obligation
stated by the labour code.
13
If a data operator considers it beneficial to its work to process a national
identification number to the detriment of the interests of natural persons, it will be
able to do so, on grounds of the legitimate interest, even if it affects the latter’s rights
if one were to assess them. In other words, the legitimate interest scheme looks like
this:
Processing personal data in the context of employment relations and the
processing of health data will be analyzed separately in distinct sections.
2.2.4 The Provisions of the Law No. 238/2009 Regarding the Regulation
of Personal Data Processing by the Structures/Units
of the Ministry of Administration and Interior in the Activities
of Preventing, Investigating and Fighting Crimes, as Well
as Maintaining and Securing Public Order
This law regulates the automatic and non-automatic processing of personal data for
the purpose of carrying out activities for the prevention, investigation and combating
of crimes, as well as for the maintenance and ensuring of the public order by the
structures/units of the Ministry of Administration and Interior (M.A.I), according to
their competencies.
To carry out the activities provided above, the structures/units of M.A.I. collects
personal data, with or without the consent of the person concerned, under this law.
In addition, the collection of personal data without the consent of the person
concerned shall only be made if this measure is necessary to prevent imminent
danger at least to the life, physical integrity or health of a person or property, as well
as to combat a particular offence.
The procedure involving the collection of personal data for carrying out the
activities provided in art. 1 par. (1) of this law, shall be performed by the staff of
the M.A.I. only for the purpose of fulfilling his/her duties and limited to the data
necessary to be collected for the purposes previously mentioned. Global collection
of data and not limited in time is not permitted.
Personal data held by the M.A.I. for the purposes set out by the present law may
be transferred to the following recipients if there is an express legal provision in the
13 https://www.dlapiper.com/en/uk/focus/eu-data-protection-regulation/key-changes.
294
E. Lazar and D. N. Costescu
obligation (provided by the law in a broad sense, such as law, decision, ordinance,
local council decision etc.), we will have to follow the other legal bases mentioned
above.
For example, displaying the CNP on tax invoices or in the “customer” or
“representative” field may fall into another legal category than the legitimate interest,
so appointing a DPO will be necessary. This is not the case though when we ask an
employee for the CNP to write up the employment contract, as this is an obligation
stated by the labour code.
13
If a data operator considers it beneficial to its work to process a national
identification number to the detriment of the interests of natural persons, it will be
able to do so, on grounds of the legitimate interest, even if it affects the latter’s rights
if one were to assess them. In other words, the legitimate interest scheme looks like
this:
Processing personal data in the context of employment relations and the
processing of health data will be analyzed separately in distinct sections.
2.2.4 The Provisions of the Law No. 238/2009 Regarding the Regulation
of Personal Data Processing by the Structures/Units
of the Ministry of Administration and Interior in the Activities
of Preventing, Investigating and Fighting Crimes, as Well
as Maintaining and Securing Public Order
This law regulates the automatic and non-automatic processing of personal data for
the purpose of carrying out activities for the prevention, investigation and combating
of crimes, as well as for the maintenance and ensuring of the public order by the
structures/units of the Ministry of Administration and Interior (M.A.I), according to
their competencies.
To carry out the activities provided above, the structures/units of M.A.I. collects
personal data, with or without the consent of the person concerned, under this law.
In addition, the collection of personal data without the consent of the person
concerned shall only be made if this measure is necessary to prevent imminent
danger at least to the life, physical integrity or health of a person or property, as well
as to combat a particular offence.
The procedure involving the collection of personal data for carrying out the
activities provided in art. 1 par. (1) of this law, shall be performed by the staff of
the M.A.I. only for the purpose of fulfilling his/her duties and limited to the data
necessary to be collected for the purposes previously mentioned. Global collection
of data and not limited in time is not permitted.
Personal data held by the M.A.I. for the purposes set out by the present law may
be transferred to the following recipients if there is an express legal provision in the
13 https://www.dlapiper.com/en/uk/focus/eu-data-protection-regulation/key-changes.
294
E. Lazar and D. N. Costescu