The National Supervisory Authority finalized an investigation at the controller Tip Top Food Industry S.R.L. and found that it infringed the provisions of Article 5 paragraph (1) letters b) and c) and paragraph (2) and Articles 6 and 7 of the General Data Protection Regulation.

Therefore, the controller Tip Top Food Industry S.R.L. was sanctioned with a fine in amount of Lei 24,362.5 (the equivalent in Lei of the amount Eur 5,000).

Following the investigation, the National Supervisory Authority found that the controller processed the image of its employees, excessively, through cameras installed in spaces defined as dressing rooms and dining areas, invoking the purpose of protecting the company’s goods and products, as well as discouraging theft.

In this context, the National Supervisory Authority considered that the processing of personal data was not adequate, relevant and limited to what is necessary for the purposes for which they are processed (”data minimisation”), thus the principles provided under Article 5 paragraph (1) letters b) and c) from the General Data protection Regulation being breached.

The National Supervisory Authority considered that the purpose declared by the controller (protection of goods, of the products of the company and discouragement of theft) could be achieved through less invasive means for the private life of the employees.

In the other hand, within the investigation performed, given the employer-employee relationship, it was considered that the consent of the data subject cannot be deemed as freely given and another legal basis for the processing was not able to be identified, the controller not being able to prove the observance of the processing principles, by reference also to Article 5 paragraph 2 of the General Data Protection Regulation.

Also, the following corrective measures have been applied to the controller:

the corrective measure to ensure the compliance of the data processing operations within the video monitoring activity, with the observance of the ”data minimisation” principle, by reference to Article 5 paragraph (1) letter c);
to re-analyse the orientation of the angle of capture of the video images so these no longer monitor the activity of its employees in dressing rooms and dining areas, by reference to the purpose of the processing.

The investigation was started following an intimation from a natural person that stated that the company TIP TOP FOOD INDUSTRY S.R.L. is processing personal data (respectively, the image) through video surveillance cameras installed in the employees’ offices, the dressing rooms and the dining area.

Legal and Communication Department

ANSPDCP