Asociația de proprietari Bl. FC 5, orașul Năvodari, județul Constanța – €500 Fine (Romania, 2020)

The owners association of an apartment building had extracted an image of a data subject from its video surveillance system, and then posted the image on the notice board of the building. Furthermore, an application made it possible for the images to be accessed remotely through the internet. Was the posting of the image on the notice board of the building lawful in accordance with Articles 5, 6, 12, 13, 25, and 32 GDPR? The ANSPDCP first held that the processing of the image coming from the video surveillance system occurred unlawfully, as it breached Articles 5 and 6(1) GDPR. For this violation, the DPA used its powers under Article 82(5)(a) and fined the association with €500. Second, the ANSPDCP held that the controller breached Articles 25 and 32 GDPR by not adopting adequate technical and organisational security measures to protect the personal data captured by the video surveillance system. For this violation, the DPA referred to Article 83(4)(a) and issued a warning. In addition, the ANSPDCP ordered the controller to adopt appropriate protective measures, such as deactivating the application that allowed the images to be remotely accessed through the internet and limiting the number of people who have access to the system. Third, the DPA held that the controller breached Articles 12 and 13 GDPR by failing to adequately inform data subjects who were filmed by the video surveillance system of the association. In this context, the ANSPDCP made a reference to Article 83(5)(b) GDPR and issued a warning. In addition, the DPA also used its corrective powers and ordered the controller to provide data subjects, within 15 days and in a visible place, with complete information with regards to the personal data processing of the video surveillance system.