On 26 June 2025, the Romanian DPA announced new sanctions, consisting of 2 fines of 2000 EUR and 1000 EUR respectively and a reprimand, imposed for a controller active in the customized consumer goods sector for several violations of the GDPR.
The sanctions were applied following an investigation triggered by a complaint submitted by a natural person alleging possible violations of personal data processing regarding the monitoring of employees by audio-video surveillance systems (CCTV).
Further to the investigation, the Romanian DPA found that the controller failed to properly inform employees in advance about CCTV monitoring and did not show that less intrusive methods had been considered first. In addition, the controller did not prove that it responded, within the legal timeframe, to the requests received from the data subject regarding access, deletion and opposition, and also did not provide a copy of the audio-video recordings requested by the employee for the period in question. Moreover, it was found that a message forwarding filter was installed within the company without the operator’s knowledge, which resulted in documents belonging to a data subject, including medical ones, being disclosed to people outside the company.
The Romanian DPA also applied a series of corrective measures to ensure the controller’s compliance with GDPR. These include restricting the use of external CCTV to the company’s perimeter only, and removing cameras from offices, the warehouse, and the production hall, where there is no clear legal basis for monitoring. The controller must also fully inform data subjects about how their personal data is processed, establish clear internal procedures for handling data subject requests, and respond within the legal timeframe. Additionally, a proper internal policy must be implemented for identifying and managing data security risks, along with appropriate staff training. The controller is also required to provide a full response to the data subject who requested access, erasure, and objection to the processing of their personal data.
The press release is available here (only in Romanian).
