The National Centre for Personal Data Protection ('NCPDP') announced, on 31 May 2022, that it had found an individual in violation of Articles 4(1)(a) and (c) of the Law of 8 July 2011 No. 133 on Personal Data Protection, following a complaint.

Background to the decision

In particular, the NCPDP detailed that a group of persons alleged that their neighbour had violated their right to privacy through a video surveillance camera installed in their area. More specifically, the NCPDP noted that the petitioners explained that the video surveillance system had been installed without their consent.

Findings of the NCPDP

During its examination, the NCPDP highlighted that the angle of the video surveillance camera revealed that it comprised a part of the courtyard of the surveillance camera owner's house and a portion of the public road, to which an unlimited number of personal data subjects have access. At the same time, the NCPDP clarified that it did not appear that the private property of the petitioners fell within the angle captured by the video surveillance device.

In addition, the NCPDP noted that, in general, the processing of personal data through a video surveillance system used to protect property may take place where the video surveillance cameras capture exclusively the private space used by the owner or manager of the rooms for personal and family needs. Furthermore, the processing of such personal data is exempted from the Law if this processing does not violate the rights of the subjects whose data is captured through the device.

Moreover, where the angle of the video surveillance cameras exceeds the private space of the owner or manager of the cameras used for personal or family needs, the applicability of the Law would then apply. Importantly, the NCPDP clarified that if the cameras are oriented towards the private property of third parties (including houses, doors, apartment windows, or neighbours' courtyards), then the processing of data through these rooms can take place only with the written consent of the persons targeted.

Considering the above, the NCPDP found that the owner of the surveillance camera violated the provisions of Article 4(1) (a) and (c) of the Law, namely where the surveillance camera processed the personal data of data subjects using the road.

Outcomes

Consequently, the NCPDP ordered the owner of the surveillance camera to suspend the processing of personal data carried out excessively in relation to the stated purpose.

You can read the press release, only available in Romanian, here.