CCR rejects PNL challenge against law on protection of personal data

The Constitutional Court of Romania (CCR) has rejected, as groundless, the challenge that the National Liberal Party (PNL) lodged against the law on the protection of natural persons as regards the processing of personal data by relevant authorities, a law that obligates operators to inform the persons concerned – within 60 days at most – that they are under surveillance. “Following the deliberations, the Constitutional Court has unanimously rejected the constitutional challenge, as groundless, and has noted that the law on the protection of natural persons as regards the processing of personal data by relevant authorities for the purpose of preventing, discovering, investigating, criminally prosecuting and fighting crimes or of enforcing sentences, educational and safety measures, and as regards the free circulation of the said data, on the whole, and the provisions of Article 12, Paragraphs (1)-(5), Article 13, Article 14, Article 15, Paragraphs (1)-(5), and Article 16 in particular, are constitutional in relation to the criticism levelled. The decision is final and mandatory and is communicated to the President of Romania,” Constitutional Court representatives point out in a communique issued on Tuesday. The bill tabled by Senators Serban Nicolae and Adrian Nicolae Diaconu (PSD) was adopted by the House, as the decisive Chamber, on October 10. The Liberals challenged the law at the Constitutional Court on October 17. In the text of their challenge, the PNL argue that the law on the protection of natural persons as regards the processing of personal data violates the provisions of Article 1, Paragraph 3, of the Constitution and of Article 145 of the Criminal Procedure Code. The law on the protection of natural persons as regards the processing of personal data by competent authorities, adopted by the House on October 10, stipulates that the operators have the obligation to inform the persons concerned within 60 days. “The operators are obligated to institute the organisational, technical and procedural measures needed to relay the necessary information to the persons concerned and to ensure the conveying of an answer regarding the data processing that took place (…) or the notifying of the persons concerned in case a security incident occurs. The operator has the obligation to notify in writing the person concerned. The answer is sent free of charge within 60 calendar days at most,” reads Article 12 of the law. Another provision of the adopted law shows that operators are obligated to communicate supplementary information to the persons concerned, such as the period during which they will be under surveillance. “On demand, when the law does not stipulate otherwise, the operator relays the following supplementary information to the person concerned: the juridical grounds of the data processing; the period during which the personal data will be stored or, in case that is not possible, the criteria used to establish the said period; if need be, the categories of recipients of the personal data, including from other countries or from international organisations; any other supplementary information, depending on the specificity of the data processing activities, especially when the personal data is collected without the person concerned being aware,” reads Article 14 of the law adopted by the House. According to the law, operators will also be obligated to state the purpose of the data processing. “The operator is obligated to communicate the following information: the purposes and juridical grounds of the data processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data was divulged,” reads Article 16 of the law adopted by Parliament.  

The post CCR rejects PNL challenge against law on protection of personal data appeared first on Nine O' Clock.