Romanian NGO files complaint to the European Commission on national implementation of the GDPR

General Data Protection Regulation

The General Data Protection Regulation (GDPR) allows Member States to introduce certain derogations in the national implementation of the Regulation.

On 14 February, ApTI Romania (the Association for Technology and Internet) filed a complaint to the European Commission analysing the problematic derogations under Romanian law and arguing that the national implementation of the GDPR is in breach of EU law.

Here are the main points of the complaint:

1. Political parties and organisations are allowed to process personal data, including sensitive data without consent and appropriate safeguards, thus disregarding basic data protection principles;

2. Processing of personal data for journalistic purposes is very limited and could block publishing of public interest stories. GDPR must not be used as a tool to silence freedom of the press;

3. Derogations for public authorities leads to a void in application of the GDPR in the public sector. The DPA has to issue tailor made "remedy plans" for public authorities to implement after committing data protection violations.

Civil society organisations have long warned that the derogations allowed under the GDPR could lead to differences in the level of protection of personal data within Member States, including in the context of elections. They also risk undermining the enjoyment of fundamental rights, such as privacy and freedom of expression. There is an urgent need for clear guidelines on the scope of these provisions and we welcome the recent announcement by the European Data Protection Board to develop a general statement on the protection of personal data in the electoral context.

However, the issues raised by the complaint need to be thoroughly addressed. A rapid intervention from the European Commission is required in order to ensure a correct and consistence application of the GDPR, as well as independence and impartiality of the national data protection authorities.

The full text of the complaint is available in English here.


Contribution by Privacy International Mozilla Fellow Valentina Pavel.

Image: GDPR by olena leus from the Noun Project, CC-BY