Law project on GDPR application in Romania – First part

Recently, a law project has been submitted to Senate on measures for implementing EU Regulation 2016/679 of the European Parliament and of the Council from April 27, 2016 on the protection of personal data and the free movement of such data and repealing Directive 95 / 46 / EC (General Data Protection Regulation – “GDPR”).  The project was submitted to the Senate and it is under public consultation until May 13, 2018. We present you further on the practical aspects of this new Project.

General provisions
The project brings changes, among others, related on: (a) processing Social Security Number (SSN), (b) video surveillance of employees, (c) processing of genetic, biometric or health data, (d) GDPR application.

In today’s article, we present you the provisions related to (a) SSN and will continue with this subject by detailing points (b) to (d) in the article we will be publishing here on Wednesday, April 4, 2018.

(a) Processing Social Security Number (SSN)

The project includes the SSN in the broader category designated as national identification number, including the health insurance number, the serial number and the identity card number, the car license number, the passport number, providing that it can only be processed under certain conditions mentioned in the GDPR. For situations where the SSN or other national identification numbers are processed for the purpose of fulfilling a legitimate interest of the operator or a third party, the operator must implement the following additional measures:

• Taking technical and organizational measures to ensure the minimization, security and confidentiality of the processing.
• Naming a Data Protection Officer (DPO).
• Joining a code of conduct approved by the supervisor authority.
• Setting deadlines for data storage and deletion.
• Ensure regular training of the employees involved in the processing activity.