RomaniaGDPR Articles 12-21 and Legea nr. 190/2018 Article 8, Data Subject Rights in Romania
Regulation (EU) 2016/679, Arts. 12-21; Legea nr. 190/2018, Art. 8
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/203151In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Romania within one month of receipt.
- You need not give effect to the rights of access, rectification, restriction or objection, or, for archiving in the public interest, also notification and portability, for data you process in Romania for scientific or historical research, statistical purposes or such archiving, to the extent they would make that purpose impossible or seriously impair it and the derogation is necessary, under Legea nr. 190/2018 Article 8.
These lines are LexLint's reading of the law's text. Also read by: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (guidance, recorded ); Case C-307/22 FT v DW, judgment of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.dataprotection.ro/servlet/ViewDocument?id=1650
- Case citation
- Case C-307/22 FT v DW, judgment of (First Chamber)
- Guidance body
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Open questions
- Does Article 8(1) of Legea nr. 190/2018, as amended by Legea nr. 233/2019, disapply the rights of access, rectification, restriction and objection for statistical purposes on the same terms as for scientific or historical research, given that the supervisory authority's guide describes the research derogation without mentioning statistical purposes?
What it makes you log
Logging duty
Articles 12 to 21 set how and when a controller answers a rights request. They state no duty to create, keep or produce a log or record of the request or the answer. Law 190/2018 Article 8 disapplies Articles 15, 16, 18 and 21 (and 19 and 20 for archiving) where the rights would make research, statistical or archiving purposes impossible or seriously impair them; it states no record duty.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Romania can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
Article 8 of Law 190/2018 disapplies access, rectification, restriction and objection for scientific or historical research or statistical purposes, and also notification and portability for archiving in the public interest, where those rights would make the purpose impossible or seriously impair it and the derogation is necessary, subject to the safeguards of GDPR Article 89(1).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .