RomaniaLaw 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 4, Paragraphs 1 to 4, Confidentiality of Communications
Art. 4 alin. (1)-(4), Legea nr. 506/2004
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/56973In force.
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Security
As of .
What it requires
- Do not listen to, record, store or otherwise intercept or monitor communications transmitted through public electronic communications networks or publicly available electronic communications services, or the related traffic data, unless the users who take part in the communication carry out the operation, those users gave their prior written consent, or the competent authorities carry it out under the law (article 4, paragraph 2).NIST Privacy FrameworkCT.PO-P1
- Keep the confidentiality of such communications and their traffic data when you store them technically to transmit the communication (article 4, paragraphs 1 and 3).NIST Privacy FrameworkPR.DS-P1
- Make recordings of such communications in the course of lawful professional practices only as the law authorizes, and only to provide proof of a commercial act or of a communication made for commercial purposes (article 4, paragraph 4).NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
2 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 13(2) sets a fine of RON 5,000 to RON 100,000 for these contraventions and, for a company with turnover above RON 5,000,000, a fine of up to 2 percent of turnover.
- Rule
- Higher of
- As of
- Minimum
- 5,000
- Currency
- RON
- Fixed cap
- 100,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record the contraventions and apply the sanctions (article 13(5)).
Settledness
- As of
- Open questions
- Is a recording made by a company's call system on behalf of its employee 'realizat de utilizatorii care participÄ la comunicarea respectivÄ' under Article 4(2)(a) of Legea nr. 506/2004?
What this law does
Article 4(1) of Law 506/2004 guarantees the confidentiality of communications transmitted through public electronic communications networks and publicly available electronic communications services, and the confidentiality of the related traffic data. Article 4(2) prohibits listening, recording, storing and any other form of interception or surveillance of communications and the related traffic data, except in the cases that follow.
The first exception covers operations carried out by the users who take part in the communication. The second exception covers operations to which the users who take part in the communication gave their prior written consent. The third exception covers operations carried out by the competent authorities under the conditions of the law. Article 4(3) leaves in place the technical storage needed to transmit the communication, provided confidentiality is respected.
Article 4(4) leaves in place recordings authorized under the law and made in the course of lawful professional practices to provide proof of a commercial act or of a communication made for commercial purposes. Article 13(1)(h) makes failing to respect the prohibition on interception and surveillance in article 4(2) a contravention.
Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover. Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.