faced with the threat that the European Commission would bring infringement
proceedings against it,
36 after more than two years since the RCC decision and the
implicit revocation of the Law 298/2008, the Parliament passed a new law for
transposing Directive 2006/24/EC (Law 82/2012), in order to avoid a negative
decision of the CJEU. But, as a result of the invalidation of the Directive, like all
the other Member States, Romania had to repeal the law transposing the Directive
2006/24/EC.
4.3 The Provisions of the New Romanian Retention Law
Although the Law 82/2012 managed to improve in a certain manner some technical
provisions previously criticized by the RCC, still did not provide a satisfactory level
of protection of individuals’ rights as the procedure for obtaining the retained data is
not very clearly regulated and was later on declared non-constitutional by the RRC
decision.
37
The New Retention Law no. 235/2015 which represent more of a supplement to
the law 506/2004 previously analysed, seeks to regulate access to data held by
providers of public networks for electronic communications and providers of electronic communications services. In addition, it aims at providing objective criteria
for regulating: the access and use of personal data by public authorities and institutions, in particular the provisions relating to the obligation to obtain prior authorization issued by courts for such access. Previously such authorization by the courts
was not required. We need to emphasise that this authorization is different from the
one analysed in Sect. 2.2.4.
38
The Law introduces the concept of ‘equipment identification data’ in addition to
the previously existing concepts of traffic data and location data (both of which have
to be retained by the Providers). However, privacy specialists already consider
‘equipment identification data’
39 as already included in the obligation to retain traffic
and location data. This refers to technical data held by the Providers concerning the
localization of the user’s communication equipment used by the Providers for the
36 The European Commission initiated the procedure for the infringement by letter C(2011) 4111 of
16 June 2011, in the case 2011/2089, for not implementing the data retention directive, in which
Romania was asked to communicate the measures for national transposition of Directive 2006/24/
EC, within two months.
37 CCR decision 440 from July 2014.
38 See Bibicu et al. (2015).
39 1. In Article 2 (1), a new letter, letter b1) shall be inserted after point (b), with the following
wording: “b1) equipment identification data – the technical data of the providers of publicly
available communications services and of the provider of public electronic communications
networks that allow the identification of the location of their communication equipment processed
for the purpose of transmitting a communication over a network of electronic communications or
for the purpose of invoicing the value of the transaction;”
Data Protection Regulations: Overview of the Romanian Legislation and. . .
305
proceedings against it,
36 after more than two years since the RCC decision and the
implicit revocation of the Law 298/2008, the Parliament passed a new law for
transposing Directive 2006/24/EC (Law 82/2012), in order to avoid a negative
decision of the CJEU. But, as a result of the invalidation of the Directive, like all
the other Member States, Romania had to repeal the law transposing the Directive
2006/24/EC.
4.3 The Provisions of the New Romanian Retention Law
Although the Law 82/2012 managed to improve in a certain manner some technical
provisions previously criticized by the RCC, still did not provide a satisfactory level
of protection of individuals’ rights as the procedure for obtaining the retained data is
not very clearly regulated and was later on declared non-constitutional by the RRC
decision.
37
The New Retention Law no. 235/2015 which represent more of a supplement to
the law 506/2004 previously analysed, seeks to regulate access to data held by
providers of public networks for electronic communications and providers of electronic communications services. In addition, it aims at providing objective criteria
for regulating: the access and use of personal data by public authorities and institutions, in particular the provisions relating to the obligation to obtain prior authorization issued by courts for such access. Previously such authorization by the courts
was not required. We need to emphasise that this authorization is different from the
one analysed in Sect. 2.2.4.
38
The Law introduces the concept of ‘equipment identification data’ in addition to
the previously existing concepts of traffic data and location data (both of which have
to be retained by the Providers). However, privacy specialists already consider
‘equipment identification data’
39 as already included in the obligation to retain traffic
and location data. This refers to technical data held by the Providers concerning the
localization of the user’s communication equipment used by the Providers for the
36 The European Commission initiated the procedure for the infringement by letter C(2011) 4111 of
16 June 2011, in the case 2011/2089, for not implementing the data retention directive, in which
Romania was asked to communicate the measures for national transposition of Directive 2006/24/
EC, within two months.
37 CCR decision 440 from July 2014.
38 See Bibicu et al. (2015).
39 1. In Article 2 (1), a new letter, letter b1) shall be inserted after point (b), with the following
wording: “b1) equipment identification data – the technical data of the providers of publicly
available communications services and of the provider of public electronic communications
networks that allow the identification of the location of their communication equipment processed
for the purpose of transmitting a communication over a network of electronic communications or
for the purpose of invoicing the value of the transaction;”
Data Protection Regulations: Overview of the Romanian Legislation and. . .
305