RomaniaGDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP Rules
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain explicit consent or express legal authorization, with adequate protective measures, before using genetic, biometric, or health data of a person in Romania to drive an automated decision or profile.NIST Privacy FrameworkCT.PO-P1
- If you rely on legitimate interests to process a Romanian national identification number, put in place appropriate technical and organizational measures, appoint a Data Protection Officer, set specific retention terms with deletion or review deadlines, and train staff periodically.NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkGV.AT-P1NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text. Also read by: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.dataprotection.ro/servlet/ViewDocument?id=1650
- Guidance body
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Open questions
- What counts as a duly justified case ('cazuri temeinic justificate') that lets an employer keep employee monitoring data longer than the 30 days that Article 5 of Legea nr. 190/2018 sets as the limit?
- Which measures count as appropriate measures ('măsuri corespunzătoare') under Article 3(1) of Legea nr. 190/2018 for processing genetic, biometric or health data to take an automated decision or build a profile?
What it makes you log
Log retention
A ceiling on how long an employer may store employees' personal data collected through electronic-communications or video monitoring (Article 5, point e), unless a law expressly provides otherwise or the case is well justified.
- Unit
- Days
- As of
- Basis
- Fixed
- Maximum value
- 30
Logging duty
Article 3(1) allows automated decision-making and profiling on genetic, biometric or health data on explicit consent or express legal provisions, with protective measures, and Article 4(2) requires safeguards (including set retention terms) for processing a national identification number on legitimate interests. Neither requires a log, record or documentation to be made or kept. Article 5 conditions employee monitoring on prior information and consultation of employee representatives.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Article 3(1) of Law No. 190/2018 adds a Romanian rule tied to automated decision-making rather than employment: processing genetic, biometric, or health data for automated decision-making or profiling is permitted with the data subject's explicit consent or under express legal provisions, with measures to protect the data subject's rights, freedoms, and legitimate interests.
Article 4(2) covers the national identification number: where a controller relies on legitimate interests to process it, the controller must apply appropriate technical and organizational measures, appoint a Data Protection Officer, set specific retention terms with deletion or review deadlines, and train staff periodically.
Article 5 of the Act permits an employer to process employee data through electronic-communications or video monitoring only on stated conditions, including prior information of the employees, and the Act has no separate rule on employee biometric data.
When LexLint raises it
When your app profile says your app processes biometric data, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .