On 12 May 2022, the Romanian DPA announced it sanctioned a company acting as a processor with a EUR 1,000 fine for failure to ensure confidentiality of the images captured following the use of CCTV system in a gas station.
The investigation was launched following the receipt of a complaint denouncing the publication on a social media platform of images relating to the data subject who made the complaint. The images originated from a CCTV monitor installed in a gas station in Harghita county.
During the investigation, the Romanian DPA found that the fined company has not implemented sufficient technical and organizational measures to ensure personal data confidentiality, particularly in respect of proper training the persons who were involved in processing the personal data.
In addition to the fine, the Romanian DPA imposed a corrective measure, ordering the fined company to organize regular training sessions for the persons acting under its authority (employees and collaborators) on their obligations regarding the personal data processing by means of CCTV, on access control to CCTV recordings and on the early detection, management and reporting of personal data breaches.
The press release is available here (only in Romanian).
