On 20 January 2022, the Romanian DPA announced it sanctioned a retail company with a fine of EUR 3,000 for the failure to provide to a data subject the complete copy of video recordings, based on data subject’s access right request.
The investigation was launched following the receipt of a complaint from a data subject who denounced that the controller failed to provide such copy of video recordings for the period in which the data subject was in the controller’s commercial premises.
The Romanian DPA concluded that controllers have the obligation to provide video recordings which contain images of the data subjects, following the receipt of request for exercising their right of access. In this context, some images may be blurred if they may affect the rights and freedoms of other individuals.
It is not the first time when Romanian DPA applies sanctions for the failure to comply with rights of access-related obligations. Until now, from what is publicly known, the sanctions for non-compliance in this field vary from warning to EUR 5,000. However, as far as we know, it is for the first time when Romanian DPA sanctions a controller for the failure to provide the complete copy of video recordings comprising the image of the data subject who makes use of the right of access.
The press release is available here (only in Romanian).
