Complaints addressed directly to the national supervisory authority for personal data processing

National Supervisory Authority for Personal Data Processing (A.N.S.P.D.C.P.) is the public authority, autonomous and independent, with legal personality, who monitors and controls, from the point of view of legality, the processing of personal data which fall under the incidence of the Law no. 677/ 2001.

Law no 677/ 2001 for the protection of persons as concerns the processing of personal data and the free movement of these data:

Article 25: Complains addressed to the supervisory authority

• (1) For the protection of the rights provided by this law, the persons whose personal data are processed under the incidence of this law can wave a complaint to the supervisory authority. The complaint can be addressed directly or through a representative. The data subject may empower an association or a foundation to represent his/her interests.
• (2) The complaint addressed to the supervisory authority is invalid if legal prosecution - having the same object and the same parties - has been already initiated.
• (3) Except for the cases when a delay would cause imminent and irreparable damage, the complaint submitted to the supervisory authority must not be addressed earlier than 15 days since a complaint on that same case was submitted to the data-controller.
• (4) In order to solve the complaint, the supervisory authority can, if necessary, hear the data subject's view, the data-controller's view, and the views of the empowered person or the association or the foundation that represents the interests of the data subject. These persons have the right to submit requests, documents and memoirs. The supervisory authority can order an expertise.
• (5) If the petition is found well-grounded, the supervisory authority can decide any of the measures provided at article 21 paragraph (3) letter d). Temporary interdiction of data processing can be established only until cessation of the reasons that have determined such measures.
• (6) The decision must be motivated and shall be communicated to the parties involved within 30 days from the date the complaint was received.
• (7) The supervisory authority can order, if necessary, the suspension of some or all data-processing operations until the complaint is solved, under the provisions of paragraph (5).
• (8) The supervisory authority can appeal to a court of law to protect the rights of the data subjects as guaranteed by the present law. The competent court of law is the Court of Bucharest. The summons is exempt from stamp taxes.
• (9) At the request of the data subjects, on grounded reasons, the court can decide the suspending of data-processing until the complaint addressed to the supervisory authority is solved.
• (10) The provisions of paragraph (4) and (9) also apply to the situation when the supervisory authority finds out, by any other means, about the infringement of the rights of the data subjects as recognised by this law.