DPA case Warning issued to Cluj-Napoca Municipality – Violation Found (Romania, 2020)

The Romanian DPA (ANSPDCP) received a complaint regarding the violation of the GDPR by the General Directorate of Local Police Cluj-Napoca regrading the personal data processing using the "Body-Worn Camera" (which processes image and voice). Does the controller processed the personal data using the "Body-Worn Camera" (which processes image and voice) according to Article 5(1)(a) GDPR and Article 6(1) GDPR? The ANSPDCP found that the staff of the General Directorate of Local Police Cluj-Napoca processed personal data without a legal basis by using the portable audio-video system type "Body-Worn Camera". The controller did not have a legal obligation for the processing and did not fulfilled any other requirement of Article 6(1) GDPR. The General Directorate of Local Police Cluj-Napoca started the non-compliant processing on October 2019 when the "Body-Worn Camera" recording system was used by local police officers in the exercise of their duties to record the following categories of interventions and actions: a) establishing the identity of persons; b) driving people to the local police headquarters; c) using force and weapons; d) performing body or luggage search; e) stopping vehicles; f) finding flagrant offenses and misdemeanors; g) preventing of an imminent danger to the life, health and physical integrity of a person. The Romanian DPA issued the warning because the controller processed the personal data (image, voice) without fulfilling the legality conditions provided in Article 6(1) GDPR. In addition, the ANSPDCP applied a corrective measure through a remediation plan according to which the controller must ensure the compliance of the processing operations, performed by using the portable audio-video systems of the “Body-Worn Camera” type, with the provisions of Article 5 and Article 6 GDPR.