New Data Privacy Provisions

The National Supervisory Authority for Personal Data Processing (“ANSPDCP”) has approved the proposed procedure for receiving and resolving complaints.

The procedure sets out the conditions that must be met in order for the ANSPDCP to consider a complaint valid.

Complaints must be in writing, in either English or Romanian, and can be filed physically, at the ANSPDCP registry, or online via the electronic form available on the ANSPDCP website.

The petitioner must describe the subject matter of the complaint, any actions taken by the petitioner towards the controller or processor and any supporting information, as well as any conclusive evidence, if available.

The procedure sets out specific rules regarding the information to be provided depending on the subject matter of the complaint. For instance, if the complaint concerns the right to privacy in the field of electronic communications and e-commerce, then it is mandatory for the petitioner to mention the phone number(s), fax number(s) or IP address(es) related to the complaint, but if the complaint concerns unsolicited commercial communications sent to the petitioner, the received commercial communication must be attached, to enable identification of the sender by the ANSPDCP.

An important provision is determining the competent court responsible for adjudicating data privacy related complaints. This should either be the court located closest to the headquarters of the controller or processor or the court responsible for the data subject’s area of residence.

The procedure also provides the official form to be used for filing a complaint.

Decision no. 133 was taken on 3 July 2018 approving the procedure for receiving and resolving complaints. It was published in the Official Gazette of Romania no. 600 dated 13 July 2018 Part I and came into force on the date of publication.