Specific processing situations

Freedom of expression

For processing for journalistic purposes or for academic, artistic or literary expression, the Law does not apply if three conditions are met together: the controller processes the data with the intention of publishing material, publication would be in the public interest, and applying the Law would be incompatible with those purposes art. 51(1).

The National Centre for Personal Data Protection does not supervise these operations art. 51(2). A data subject who considers that the conditions have not been met may bring an action before a court and claim compensation art. 51(3). The exception does not cover access to information of public interest, which has its own rule art. 51(4).

Access to information of public interest

Personal data held by controllers may be disclosed under the conditions of Law No. 148/2023 on Access to Information of Public Interest, except for special categories of data art. 52(1). This rule does not concern a person’s request for access to his or her own data; such a request follows the rules on data subject rights art. 52(2).

The national identification number

The national identification number is the number by which a natural person is identified in certain filing systems and which is of general application, such as the state identification number or the series and number of the identity card art. 4.

It may be processed, including by collecting or disclosing documents that contain it, in any of the situations of lawful processing in art. 6(1), art. 53(1). Where the basis is the legitimate interest of the controller or of a third party, the controller must put specific safeguards in place art. 53(2):

• appropriate technical and organisational measures for data minimisation and for the security of processing art. 53(2)(a);
• storage periods set according to the nature of the data and the purpose, and time limits for erasure or review art. 53(2)(b);
• regular training for the people who process the data under the direct authority of the controller or processor art. 53(2)(c).

For example, copying the identity cards of clients or visitors means collecting documents that contain the national identification number, so it needs a basis under art. 6(1) art. 53(1).

Archiving, research and statistics

Processing for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes takes place only subject to appropriate safeguards for the rights and freedoms of data subjects. The safeguards ensure in particular data minimisation and may include pseudonymisation; where the purposes can be achieved without identifying individuals, they are achieved in that way art. 54(1).

In scientific or historical research and in statistics, subject to the safeguards in paragraph (1), the rights of access, to rectification, to restriction and to object do not apply to the extent that they would render impossible or seriously impair the achievement of the purposes, and the derogation is necessary art. 54(2). For archiving in the public interest, the derogation also extends to notifying recipients and to data portability art. 54(3). The derogations apply only to processing for those purposes, not to other purposes pursued at the same time art. 54(4).

Why it matters

Infringements of the obligations in this Chapter are punishable by fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher art. 88(2)(d).