Law project on GDPR application in Romania – Second part

Recently, a law project has been submitted to Senate on measures for implementing EU Regulation 2016/679 of the European Parliament and of the Council from April 27, 2016 on the protection of personal data and the free movement of such data and repealing Directive 95 / 46 / EC (General Data Protection Regulation – “GDPR”). We present you further on the practical aspects of this new Project. The project was submitted to the Senate and it is under public consultation until May 13, 2018.

General provisions
The project brings changes, among others, related on: (a) processing Social Security Number (SSN), (b) video surveillance of employees, (c) processing of genetic, biometric or health data, (d) GDPR application.

In the article on Monday, April 2, 2018, we introduced the provisions of (a) CNP, and we continue to address this subject today with the details of topics (b) to (d).

(b) Employee Video Surveillance

In the case of employee monitors via video systems, the operator must meet the following cumulative conditions:

• The employer must have well-founded legitimate interests aimed at activities of particular importance and prevailing over the interests / rights of employees.
• The employer must clearly and completely inform employees before implementing the measure.
• The employer should consult the trade union / employee representatives before implementation.
• The employer has previously used other ways to achieve the goal, but they have not proven their effectiveness.
• The data must be stored for a period commensurate with the intended purpose, and it may not exceed 30 days, except in cases provided for by law or in cases duly justified.

(c) Processing of genetic, biometric or health data

The project provides that the processing of genetic, biometric or health data for the purpose of automated decision-making or profiling is forbidden, unless this is done by a public authority or under the control of such an authority. The prohibition cannot be lifted by the consent of the person concerned.

(d) Applying GDPR

The law project also stipulates that the GDPR shall apply to complaints submitted to the supervisory authority from May 25, 2018, but also to those submitted before that date and which are in progress in all aspects, including on the procedure investigation and sanctions. However, if the GDPR provides for a higher sanction than the previous legislation, the deed will be sanctioned in accordance with the provisions in force at the time of its execution.