The Centre, complaints and inspections

What the Centre is

The National Centre for Personal Data Protection is the independent national public authority that supervises the application of the Law art. 55(1), art. 58(1). It is financed from the state budget art. 56(1) and headed by a Director appointed by Parliament through a competition for a term of 7 years art. 63(1). Complaints and investigations are handled by data protection inspectors art. 68(1). The Centre does not supervise courts acting in the administration of justice art. 58(2).

Tasks and powers

The Centre monitors the application of the Law, examines complaints, conducts investigations and approves instruments such as standard contractual clauses, the list of processing operations that require an impact assessment, and binding corporate rules art. 59(1). Each year, by 31 March, it submits an activity report to Parliament and the Government art. 61(1).

Its powers are of three kinds art. 60:

• investigative: it may order any information to be provided, carry out audits, and obtain access to data and to the controller’s premises in accordance with normative acts art. 60(1);
• corrective: it may issue alerts and warnings, order processing to be brought into compliance, order data subjects to be informed, limit or ban processing, and impose fines art. 60(2);
• authorisation and advisory: it advises in prior consultation and approves codes of conduct, clauses and certifications art. 60(3).

Complaints and remedies

Any data subject may lodge a complaint with the Centre if he or she considers that the processing of his or her data infringes the Law art. 72(1), within one year of the date on which he or she could have become aware of the infringement, but no later than 3 years after it occurred art. 72(2). The data subject may also go directly to court art. 74 and may obtain compensation from the controller or processor for material or non-material damage suffered art. 76(1). The actions or inaction of the Centre may be challenged directly in court art. 73(1).

How an examination proceeds

The Centre opens an examination on a data subject’s complaint or ex officio art. 77(1). A complaint first undergoes a preliminary examination, within 30 days of registration art. 80(1). After the preliminary examination of a complaint, the Centre orders an investigation if there are reasonable grounds to suspect an infringement art. 81(2). Ex officio investigations may be triggered, among other things, by personal data breach notifications art. 81(3)(a).

The Centre first requests documents and information; an on-site investigation takes place only if these are insufficient art. 81(7). The period for providing information is at least 5 working days art. 82(2). All natural and legal persons are required to submit to the investigation art. 81(14), and the company under investigation has the right to submit evidence and explanations and to be assisted by a lawyer art. 81(12).

An investigation lasts up to 6 months, with justified extensions of one month at a time, but no more than 12 months art. 81(25). The draft decision is communicated to the parties, who have 30 days to raise objections art. 81(23).

The decision and its execution

The Centre issues a reasoned decision on whether an infringement occurred and on the measures applied art. 84(1), communicates it within 10 working days art. 84(2) and publishes a summary of its decisions art. 84(3). The decision is executed within the period it sets, which the Centre may fix at up to 6 months and, in complex cases, extend at the reasoned request of the controller or processor art. 85(1), and the period for voluntary payment of a fine is at least two months art. 85(2).