A Romanian decision sanctions a company for excessive video surveillance of its employees, notably in private areas, and for its failure to respond to a data subject access request. The authority details breaches of the principles of data minimization, storage limitation, and the obligation to conduct a data protection impact assessment.

Facts and context

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) issued a sanction decision against ASAM S.A., including a total fine of €5,000 for breaches related to handling a data subject access request and the implementation of an employee video surveillance system.

The case originated from a complaint by an individual who accused the company of not providing a complete and appropriate response to their request for access to their personal data, notably video footage related to their professional activity.

Grounds for the decision

• Obligation to facilitate the exercise of rights and respond to access requests (Articles 12 and 15 of the GDPR): The authority found that the controller did not provide a complete and adequate written response to the data subject's access request. It neither communicated all information required by Article 15(1) of the GDPR nor provided a copy of the processed personal data. The investigation also revealed the absence of appropriate internal measures to facilitate the exercise of rights, particularly regarding data from the video surveillance system.
• Compliance with processing principles and lawfulness (Article 5 and Article 6 of the GDPR): The authority judged that employee surveillance based on legitimate interest was unlawful as it was disproportionate. The video surveillance system included a significant number of cameras, some installed in areas where the right to privacy must be guaranteed (changing rooms, toilet entrances, dining rooms, offices). Moreover, the retention period of images, exceeding 30 days, was deemed excessive relative to the purposes, thus violating the principles of data minimization and storage limitation. The breach of the information obligation under Articles 12 and 13 was also upheld.
• Obligation to conduct a data protection impact assessment (Article 35 of the GDPR): The company did not carry out an impact assessment before deploying its modernized video surveillance system, although this processing involved systematic and large-scale monitoring of employees, including through the use of intelligent features. The authority recalled that this type of processing is listed among operations requiring an impact assessment, as established by ANSPDCP Decision No. 174/2018.

Authority's decision

Consequently, the authority imposed a total fine of 26,685 lei (approximately €5,000) on ASAM S.A., along with a warning for the breach of Article 35 of the GDPR.

Furthermore, the authority ordered the company to take several corrective measures. These include providing a complete response to the initial access request, implementing an internal procedure for managing data subject rights, and bringing its video surveillance system into compliance. This compliance notably involves dismantling cameras in certain areas, limiting retention to 30 days, and providing comprehensive information to individuals. Finally, the company must conduct and finalize the required impact assessment.

Lessons learned

This decision reminds that:

• Employee video surveillance cannot be justified by legitimate interest when cameras are installed in areas dedicated to privacy (changing rooms, dining rooms, etc.), as such practice violates the principle of data minimization.
• The implementation of a large-scale employee video surveillance system, especially if it uses advanced features, constitutes processing likely to pose a high risk to rights and freedoms and requires a prior impact assessment.
• The effectiveness of the right of access requires the controller to have formalized internal procedures and to train its staff to ensure a complete and timely response, including for complex data such as video recordings.