Decision no. 161/09/10/2018 of The National Supervisory Authority for Personal Data Processing (“ANSPDCP”), on the approval of the Investigations Procedure entered into force on the 23rd of October 2018, in accordance with the powers given by the General Data Protection Regulation to the supervisory authorities.
According to the new procedure, investigations can be carried out by ANSPDCP upon prior complaint or ex officio. The latter case means that ANSPDCP may perform investigations in response to data and information published in mass-media or obtained from other national public entities or from foreign supervisory authorities. Any of these investigations may be performed in order to verify the accuracy of such information without prior notification, at the headquarters of the investigated entity, at the headquarters of the supervisory authority or simply through written interrogatories.
In case of written interrogatories, a notification should be sent to the investigated entity, requesting the relevant information / data and documents (e.g. the technical and organizational measures implemented by the data controller and the documents or other evidence proving their implementation). The ANSPDCP request should also mention the obligation of the data controller (or investigated entity) to respond in writing and to attach any evidence in certified copies, within the established deadline.
Within any investigation, ANSPDCP is entitled to verify or secure any document, equipment or storage media, or to ask for judiciary authorization if ANSPDCP representatives are prevented in any way from performing their investigation. The Court’s authorization may be appealed within 72 hours but such an appeal will not suspend the enforcement of the Court’s decision.
In order to avoid the risk of destroying relevant documents, ANSPDCP representatives may seal the location/documents if they don’t finalize the investigation within one day or if any other situations arise which would justify such a measure. The inspectors may also question any person whose statement may be relevant.
Following the investigation, ANSPDCP may issue a warning sanction or apply a fine if the allegations which are the subject of the investigation are confirmed. It may also take other corrective measures or make recommendations.
Corrective measures may consist of temporary or permanent limitations, processing prohibitions, rectification or deletion of personal data, processing restrictions, notification of these actions, withdrawing a data protection certification or requiring the certification body to withdraw an issued certificate or to not issue a certification if the requirements for certification have not or no longer are being met.
According to the Investigation Procedure and Law no. 129/2018 that amends Law no. 102/2005 regarding the organization of the ANSPDCP, if the fine is lower or equal to Euro 300,000, then it may be applied directly by the ANSPDCP investigators. If the fine is higher than Euro 300,000, it must be imposed by the President of the ANSPDCP, on the basis of the investigator’s reports.
The sanctions applied by ANSPDCP can be appealed within fifteen (15) days to the administrative division of the Tribunal Court. The contestation will not suspend the execution of the corrective measure (only the payment of the fine is suspended). Any corrective measures may be suspended based only based upon a separate request and favorable court decision.
For further details on the above, you may consult the full content of the Investigation procedure at http://www.dataprotection.ro/?page=control&lang=ro.
Read the full text
Romanian data protection authority’s decision on investigation procedure
Decision no. 161/09/10/2018 of The National Supervisory Authority for Personal Data Processing (“ANSPDCP”), on the approval of the Investigations Procedure entered into force on the 23rd of October 2018, in accordance with the powers given by the General Data Protection Regulation to the supervisory authorities. According to the new procedure, investigations can be carried out […]...
Amendment of the Austrian act against unfair competition (UWG) – The directive on the protection of know-how enters into force in early 2019
Directive (EU) 2016/943 “on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure”, adopted on 8 June 2016, will be implemented in Austria by an amendment to the Federal Act against Unfair Competition (UWG) and is to enter into force on 1 February 2019. With the implementation […]...
UWG Novelle 2018 – Die Richtlinie zum Schutz von Know-How tritt in Kraft
Die am 8.6.2016 verabschiedete Richtlinie (EU) 2016/943 “über den Schutz vertraulichen Know-hows und vertraulicher Geschäftsinformationen (Geschäftsgeheimnisse) vor rechtswidrigem Erwerb sowie rechtswidriger Nutzung und Offenlegung” wird in Österreich durch eine Novelle zum Gesetz gegen den unlauteren Wettbewerb (UWG) umgesetzt und soll mit 1.2.2019 in Kraft treten. Mit der Umsetzung der Geschäftsgeheimnis-RL der EU wird der Schutz […]...
New amendment to Polish civil code has an impact on the activity of credit institutions
The Polish Parliament recently adopted the Act of 6 December 2018 on amendment to the Civil Code (the “Act”), which may be of significance to many financial institutions and borrowers. The Act provides that long-term loans granted by financial institutions will no longer be exempt from the prohibition on charging compound interest (zakaz anatocyzmu). Polish […]...
Amendment of the Hungarian labour code
Triggering intense emotions and protestation, the bill related to the amendment of the Hungarian Labour Code has been accepted by the Parliament on the 12th of December 2018, and after signature by the President of the Republic entered into effect as of 1 January 2019. In the attached, we summarize the most furiously and frequently […]...
Trademark offensive 2.0 – Full adoption of the EU trademark directive in January 2019
Following the implementation of several new provisions of Austrian trademark law in 2017, the second amendment completely implements the EU Trademark Directive in the Austrian Trademark Act (MSchG). It modernizes the concept of trademarks in Austrian law and eases access to the legal protection system. The amendment to the Austrian Trademark Act entered into force on 14 January 2019....
Serbia: Companies to register UBOs by 31 January
On 31 December 2018, the Central Register of Ultimate Beneficial Owners (“Central Register”) has been established with the Serbian Business Register Agency (“BRA”). Serbian companies, institutions, as well as branches and representative offices established by foreign investors in Serbia, are among the entities designated by the Serbian Law on Central Register as entities whose legal […]...
AML in Bulgaria: New deadlines
On 8th of January 2019 the Rules for Implementation of the Anti-Money Laundering Act (in Bulgarian: Правилник за прилагане на Закона за мерките срещу изпирането на пари) have been published. This is the key piece of legislation that was missing from the framework introduced into the Bulgarian law with the transposition of 4th EU AML […]...
Amendments of the trade unions act
On 1 January 2019, important amendments of the Trade Unions Act came into force enabling individuals engaged under civil law contracts, in particular contractors or self-employed individuals, to set up or join trade unions, provided that such individuals do not employ other persons for the same kind of work they perform for the employer. Consequently, […]...
Upcoming changes to employment documentation
The Polish Parliament has adopted an act that became effective 1 January 2019 and shortens the retention period of human resource files and allows them to be stored in an electronic form. HOW LONG TO STORE EMPLOYMENT DOCUMENTATION? Former law required employers to store documentation related to an employee and the employment relationship (“employee documentation”) […]...
Austrian GDPR-tracker: Data protection authority on erasure by way of anonymization
Destruction or anonymization of personal data – an appropriate way to comply with the right to erasure? The Austrian Data Protection Authority (DPA) has further consolidated its case law on the right to erasure. Following decisions on the relationship between erasure obligations and legal retention periods as well as on the storage of contact data […]...
Bulgaria: Government to launch concession procedures for major transport infrastructure projects
The Bulgarian Council of Ministers adopts an amitious action plan for State Concessions 2019-2020, providing the launch of tenders for major ports and airports. In the context of the pending procedure for Concession of Sofia Airport, the Bulgarian Government affirmed its interest in developing public-private partnerships through concessions in the next couple of years. On […]...