What Needs to be Done Prior to Collection

Contact the data subject

Contact the National Supervisory Authority for Personal Data Processing

Article 12: Informing the Data Subject

(1) When personal data is obtained directly from the data subject, it is the data controller’s obligation to provide the data subject with the following information, except for the situations in which he/she already has this information:

a) the identity of the data controller and, if required, of the data controller’s representative;

b) the purpose of the data processing;

c) additional information, such as: the recipients, or the categories of recipients of the data; whether the requested information is compulsory, and the consequences of the refusal to provide it; the existence of the data subject’s rights, stated by this law, notably the right of access, intervention and objection as well as the terms in which they may be exerted;

d) any other information which may be expressly requested by the supervisory authority, considering the processing’s specific situation.

(2) When the data is not obtained directly from the data subject, it is the data controller’s obligation, at the moment of collecting data or at least before the first disclosure takes place, if he has the intention to disclose the data to a third party, to provide the data subject with the following minimum information, unless the data subject already possesses that information:

a) the identity of the data controller and, if required, of the data controller’s representative;

b) the purpose of the data processing;

c) additional information, such as: the recipients, or the categories of recipients of the data; whether the requested information is compulsory, and the consequences of the refusal to provide them; the existence of the data subject’s rights, stated by this law, notably the right of access, intervention and objection as well as the terms in which they may be exerted;

d) any other information which may be expressly requested by the supervisory authority, considering the processing’s specific situation.

(3) The provisions of paragraph (2) do not apply when the processing of data is carried out exclusively for journalistic, literary or artistic purposes, if their enforcement might reveal the source of information;

(4) The provisions of paragraph (2) do not apply when the processing of data is carried out for statistical, historical or scientific research, or in any other situations if providing such information proves to be impossible or would involve a disproportional effort towards the legitimate interest that might be damaged, as well as in the situations in which recording or disclosure of the data is expressly stated by law.

Contact the National Supervisory Authority for Personal Data Processing

Article 22: The Notification Addressed to the Supervisory Authority

(1) The data controller is obliged to notify the supervisory authority, either personally or through a representative, before initiating any kind of data processing which has a similar or related purpose(s) to previous data processing activities.

(2) Notification is not necessary in the event that the sole purpose of the data processing is to keep a record available for public reference, open for consultation to the general public or to any person who proves a legitimate interest, provided that the data processing is strictly limited to such data that is necessary to the above mentioned record.

(3) The notification shall contain the following information:

a) the name, address or premises of the data controller and of his representative, as the case may be;

b) the purpose(s) of the data processing;

c) a description of the category/categories of the data subjects and of the data, or the categories of data, that is to be processed;

d) the recipients or the categories of recipients to whom the data is intended to be disclosed;

e) the guarantee accompanying the disclosure to a third party;

f) the manner in which the data subjects are informed of their rights, an estimate date on ending data processing operations and the future destination of the data;

g) transfers aboard of personal data intended to be carried out;

h) a general description that allows a preliminary assessment of the measures taken in order to ensure data processing security;

i) mention of any data filing system related to the processing, and of possible relation to other processing or other data recording systems, irrespective of the fact that they are situated on Romanian territory or not;

j) the reasons that justify the enforcement of the provisions of Articles 11 and 12 paragraph (3) or (4), or of Article 13 paragraph (5) or (6), in cases that the data processing is performed exclusively for journalistic, literary, artistic or statistical purposes, or for historical or scientific research.

(4) If the notification is incomplete, the supervisory authority shall demand its completion.

(5) Within its investigative powers, the supervisory authority may demand other information, notably regarding the data’s origin, the automatic processing technology used and details about the security measures. The provisions of this paragraph do not apply in the situations in which the data is processed exclusively for journalistic, literary or artistic purposes.

(6) If the processed data is intended to be transferred abroad, the notification shall consist of:

a) the data categories subject to the transfer;

b) the country of destination for each data category.

(7) The notification is subject to a fee that must be paid by the data controller to the supervisory authority.

(8) The public authorities that carry out personal data processing related to the activities described in Article 2 paragraph (5), based on the law or in compliance with the obligations assumed through ratified international agreements, are exempt from the fee set out in paragraph (7). The notification shall be sent within 15 days from the entering into force of the legislative act that sets out the obligation in case and shall only contain the following elements:

a) the name, address/premises of the data controller;

b) the purpose and the legal basis of the data processing;

c) the personal data categories subject to processing.

(9) The supervisory authority may establish other situations in which the notification is not required, other than those provided in paragraph (2), or situations in which the notification may be submitted in a simplified manner as well as the content of such a notification, in the following cases:

a) in situations in which, considering the nature of the data which are processed, the processing may not infringe, at least apparently, the rights of the data subject, on the condition that the purposes of that processing, the data or categories of processed data, the data subjects or categories of data subjects, the recipients or categories of recipients and the period for which the data is stored are all precisely mentioned;

b) in situations in which the processing is carried out in accordance with the provisions of Article 7 paragraph (2) letter d).

Please see Information Commissioner’s Office website for further details on the statute

www.ico.gov.uk/Home/what_we_cover/

data_protection.aspx