Case study: homeowners association
A homeowners association processes data about its residents every day. The cameras and the debtor list need a legal basis (art. 6), the data must be limited to what is necessary for the purpose and kept no longer than necessary (art. 5), and residents must be informed about the processing, including CCTV (art. 13). In this illustrative example, these requirements were not met.
The situation
A homeowners association in Chișinău with 120 flats. The cameras in the stairwells and the courtyard ran with no rules of use, no notice to residents and no retention period for the recordings, and the list of debtors was posted at the entrance with names and flat numbers. The firm that maintained the cameras had access to the recordings, and exported clips were posted to the building's group chat on request.
What was missing
- 01The cameras ran with no defined purpose and no established legal basis. Without a purpose, the association could not even judge which areas needed filming. art. 5 art. 6
- 02Residents and visitors were not informed: there were no warning signs and no notice saying who the controller is, why filming takes place, how long the footage is kept and what rights the people filmed have. art. 12 art. 13
- 03The recordings had no retention period, although data are kept only for as long as the purpose for which they were collected requires. art. 5
- 04The list of debtors, with names and flat numbers, was visible to anyone entering the building. To recover debts, the association has no need to make them public. art. 5 art. 6
- 05The maintenance firm had access to the recordings with no contract governing the processing on the association's behalf. art. 28
- 06Exported clips circulated in the building's group chat, with no rule on who has access to the footage or whom it may be passed to. art. 29 art. 32
The risks
A fine for basis, principles and notice
CCTV with no legal basis and no storage limit breaches art. 5 and 6, and the lack of notice breaches art. 13. For both, the law provides for fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher. Of the fine imposed, 10% applies in the first year after the law enters into force. art. 5 art. 6 art. 13 art. 88 art. 90
Complaints from residents
A resident whose name is on the posted list or whose footage ended up in the group chat may lodge a complaint with the Centre. For a continuing infringement, such as a list that stays up, the one-year period runs from the date of the last act. The resident may also claim compensation for non-material damage. art. 72 art. 76
Orders from the Centre
During an inspection, the Centre may require any information, obtain access to the premises and the recording equipment, and order the processing to be brought into compliance by a set deadline or temporarily limit the CCTV. Failing to comply with such a measure is a distinct infringement, punishable by a fine of up to 2,000,000 lei. art. 60 art. 88
What is in place now
- 01A CCTV policy, so that every camera serves a specified purpose and rests on an established legal basis. art. 5 art. 6 art. 24
- 02Warning signs at the entrances and a privacy notice for residents, so that the people filmed learn who processes the footage and what rights they have. art. 12 art. 13
- 03A retention period for the recordings, after which they are erased. art. 5
- 04A format for the list of debts that does not identify anyone, so that reporting on the building's finances discloses no one's data. art. 5 art. 25
- 05A written contract with the maintenance firm as a processor. art. 28
- 06Instructions for the chair and the board members on access to footage, so that it no longer circulates in group chats. art. 29 art. 32
Result
The association now has a CCTV policy, warning signs, a privacy notice for residents, a retention period for the recordings, a contract with the maintenance firm and a format for the list of debts that does not identify anyone.
For a typical homeowners association
The Essential package + extra work, 12,400 MDL
This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.
Calculate the exact price →FAQ
Questions about this case
How long may the association keep CCTV recordings?
The law sets no fixed number of days. Footage is kept only for as long as the purpose for which it is collected requires, and the period, or the criteria used to set it, is communicated to the people filmed. A longer period has to be justified by the purpose of the CCTV. art. 5 art. 13
Can the association hand recordings to a resident or the police?
A resident has the right of access to footage showing him or her, but the copy provided must not adversely affect the rights and freedoms of others, such as neighbours in the same frames. Disclosure to the police needs a legal basis, usually an obligation laid down by law. art. 6 art. 15
Does the firm that maintains the cameras need a separate contract?
Yes, if it has access to the recordings or stores them. It processes the data on the association's behalf as a processor, and that processing is governed by a contract or other legal act, in writing, including in electronic form. art. 28
Is a data protection impact assessment needed for the building's cameras?
An assessment is mandatory where the processing is likely to result in a high risk, in particular for systematic monitoring of a publicly accessible area on a large scale. Cameras in the stairwells of a single building do not usually fall into that category, but the association should also check the list of processing operations approved by the Centre. art. 35
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.