I. General Context
Starting with January 7, 2019, Law no. 363/2018 (“Law 363/2018”) entered into force. Law 363/2018 transposes Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (“Directive 2016/680”).
II. Main changes
Previously, processing of personal data for the purpose of prevention, investigation, detection or prosecution of criminal offences was regulated by Law no. 238/2009 (“Law 238/2009”), which was repealed by Law 363/2018.
Law 238/2009 had only regulated processing of personal data undertaken by the structures within Romania’s Ministry of Internal Affairs, thus the rules only basically applying to processing undertaken by the police.
Law 363/2018 provides a set of rules on processing personal data to be followed during all phases of criminal trials and applicable to all authorities involved in the prevention, investigation, detection and prosecution of criminal offences, as well as in the execution of criminal penalties. Thus, the rules apply to police, prosecutors and courts.
While most of principles and rules on processing of personal data established by Directive 2016/680 and transposed by Law 363/2018 are rather similar to the ones provided by the GDPR, which specifically does not apply to processing of personal data for the purpose of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, most are new for Romanian authorities in the field.
Thus, Law 363/2018 provides a series of rules to be followed during the processing of personal data in the field, such as, amongst others:
- establishing retention periods;
- ensuring the security of personal data;
- making a clear distinction between personal data of different categories of data subject such as suspects, convicted persons or victims of criminal offences;
- notifying personal data breaches;
- appointing a data protection officer.
Law 363/2018 also provides more details as regards the rights of the data subjects, such as right of access, right to rectification or erasure.
The Romanian Data Protection Supervisory Authority (the “Supervisory Authority”) has also been granted more powers in relation to the processing of personal data in this field and may even impose a temporary or definitive limitation, including a ban, on processing that is not compliant with the applicable rules.
Starting with February 7, 2019, the Supervisory Authority will also be able to impose fines upwards to RON 100,000 (approximately EUR 21,350) on authorities failing to comply with the new rules and failing to implement remediation plans drafted by the Supervisory Authority.
As far as any potential impact on criminal investigations, Law 363/2018 does not prevent the law-enforcement authorities from carrying out activities such as covert investigations or video surveillance. Such activities can be done for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, according to the criminal proceedings law.
Regarding the international cooperation in criminal matters, Law 363/2018 provides more details regarding the transfer of the personal data between countries. However, the purpose of the regulation is to encourage a closer cooperation between the states by promoting an efficient exchange of personal data whilst ensuring respect for fundamental rights and freedoms regarding the automatic processing of personal data.
Law 363/2018 also provides that the Supervisory Authority is involved in the cross-border context, as it may exchange information and cooperate with their foreign counterparts relating to the activities or investigations outside their borders.
While processing of personal data for the purpose of prevention, investigation, detection or prosecution of criminal offences was already regulated on a minimal level, Law 363/2018 provides more rules to follow and grants more guarantees as far as the protection of personal data of relevant data subjects.
Law 363/2018 does not interfere with specific rules for criminal proceedings, including investigation and prosecution of criminal offences, or the independence of the judiciary authorities.