On the 4^th of August 2020 the National Supervisory Authority finalised an investigation at the Owners’ Association Block FC 5, Năvodari city, Constanța county, during which it found the infringement of certain dispositions of the General Data Protection Regulation.

As such, the owners’ association was sanctioned:

for the illegal processing of the image of a natural person, from the video surveillance system of the association, by posting on the notice board of the building, in violation of the principles of personal data processing provided by Article 5 of the GDPR, corroborated with Article 6 paragraph (1) of the GDPR, in connection with the provisions of Article 83 paragraph (5) letter a) of the GDPR – fine in the amount of 2,417.55 lei (equivalent of 500 euros);
for not adopting security, technical and organisational measures, adequate for the protection of personal data collected through the video surveillance system, in accordance with the provisions of Articles 25 and 32 of the GDPR, in connection with the provisions of Article 83 paragraph (4) letter a) of the GDPR – reprimand;
for the lack of a complete information of the data subjects whose personal data they process through the video surveillance system held, according to the requirements of Articles 12 and 13 of the GDPR, in connection with the provisions of Article 83 paragraph (5) letter b) of the GDPR – reprimand.

At the same time, the following corrective measures were applied to the owners' association

to ensure the complete information of the data subjects, by providing all the information mentioned by Articles 12-13 of the GDPR, in a visible place, near the installed surveillance cameras, within 15 days from the date of communication of the minutes
to ensure the compliance of processing operations with GDPR by adopting security measures, technical and organisational, appropriate for the protection of personal data collected through the video surveillance system, including in terms of viewing images through the monitor located in the lobby and the deactivation application that allows remote access to images via the Internet, by establishing, within the General Assembly of the Owners’ Association, a limited number of people who have access to this system, the rights that can be allocated to each of them, the provision of clear processing instructions for persons processing data under the authority of the association.

The sanctions were imposed as a result of a complaint by which the petitioner claimed the access, use and disclosure by various persons, without legal grounds, of images with his person, from the video surveillance system of the owners’ association.

Legal and Communication Department

A.N.S.P.D.C.P.