The 2021 activity report is publicly available on the website of the National Supervisory Authority for Personal Data Processing under section “General information/Public Information/Annual reports”.

The annual report contains a synthetic presentation of the Authority’s activities, being structured in accordance with the main competences of ANSPDCP, in the following chapters: chapter I – General presentation, chapter II – Advisory, consultation and public information activity, chapter III – Monitoring and control activity, chapter IV – Foreign affairs activity and chapter V – The economic management of the Authority.

At the same time, this Report contains statistical benchmarks highlighted in each chapter, including graphics compared to previous years such as: the number of investigations performed in total or differentiated (ex officio, respectively based on complaints), the number of complaints and intimations received, the number of fines applied, the number of corrective measures imposed, the number of points of view issued, the number of approvals issued, the number of pending litigations, the number of press releases, the number of binding corporate rules/IMI requests.

Also, the 2021 Annual Report contains case-laws/cases regarding the investigation activity, as well as the most relevant points of view issued, which reflect the complexity of the activity performed, in connection with the tasks of our institution.

Thus, during 2021 there has been submitted to the National Supervisory Authority a number of 941 requests for opinions regarding various aspects referring to the manner of interpretation and enforcement of the Regulation (EU) 2016/679 by the controllers and their processors, from the public and private sector, by other entities, as well as by natural persons.

Also, our institution has issued opinions in relation to a number of 68 legal acts drafts prepared by public institutions and authorities that involved complex aspects regarding the processing of personal data, under Article 57 paragraph (1) letter c) of Regulation (EU) 2016/679.

In relation to the control and monitoring activity, during 2021, the Authority has received a number of 5,006 complaints, intimations and notifications regarding data breaches, based on which there have been launched 691 investigations.

Following the investigations, 36 fines in total amount of Lei 371,131.95 have been imposed. Also, 93 reprimands have been applied and 56 corrective measures and 1 warning have been ordered.

The activity report for 2021 has been provided to the competent authorities, according to the provisions of Article 5 paragraph (2) of Law no. 102/2005 regarding the set up, organisation and functioning of the National Supervisory Authority for Personal Data Processing.

Legal and Communication Department

A.N.S.P.D.C.P.