If we think of a recipe for success in terms of interpersonal conflicts, we can not help but think of the owners' associations (respectively their governing bodies) and its members. In the block of my childhood, the general assemblies of the members of the association were characterized by endless quarrels. Then, since I entered the legal profession, I have often come across various requests from acquaintances, family members regarding their relationship with the president of the association / administrator. Each time, the situation was extremely tense, the conflicts old, and the actors of the conflict extremely warriors.
Since 2018, when the RDGP Regulation came into force, the Romanian owner of an apartment in a condominium has found out that there is an authority that you are sure to address, the one you complained about is unlikely to escape sanctioned and little siphoned by a control, namely the National Authority for the Supervision of Personal Data Processing (ANSPDCP). This is also because the implementation of the rules imposed by the RGDP Regulation is precarious towards non-existence in the case of Owners Associations. Most of the management bodies of the Owners 'Associations completely ignore the fact that the Owners' Association is also a personal data operator and that it must comply with data processing rules and, at the same time, implement a procedure for the protection of processed personal data. The Romanian complainant knows this very well, so, whether or not he caught a Owners Association on the wrong foot, he can make a simple complaint to ANSPDCP as if the rights of the person concerned had been violated. Most importantly, in principle, the complaint does not involve any fee, and the procedure is quite clearly explained by the Authority by DECISION no. 133 of July 3, 2018 on the approval of the Procedure for receiving and resolving complaints (https://www.dataprotection.ro/?page=Plangeri_pagina_principala).
Recently, we were notified of a sanctioning decision with a warning of an Owners Association as a result of processing some data in violation of the provisions of art. 6 of the Regulation, a situation in which corrective measures were taken to follow the necessary steps so as to ensure, in the future, the compliance of processing operations with the provisions of RGDP (a sign that the association had not the slightest idea of GDPR). In short, the sanctioned association received from the petitioner an address regarding certain aspects that displeased her regarding the amendments to the constitutive acts of the owners' association. The association chose to answer her in writing (so far nothing to report), but the answer, addressed only to the petitioner (with her name, address and also in a pejorative and disturbing tone), pasted it on all entrances in the condominium (front door, door basement, elevator door, etc.). You can imagine what a shock the petitioner had to see her name and address displayed on all the doors of the condominium (approximately 6 entrances).
This is a model of attitude that represents a flagrant and intentional violation of the legality of data processing. Ultimately, data protection means an assurance to the data controller by a data controller that such data will not be disclosed to third parties unless the data subject gives his or her consent or there is no other reason for that disclosure. Before the GDPR, a sanction of the association for this defiant attitude could not have been achieved.
Thus, this article is not an exhortation to the plaintiffs and complaints, but rather an exhortation for the management bodies of the Owners Association to update themselves on the new rights and obligations of condominium owners and to implement and raise awareness of some reguli de baza on the processing of personal data:
- drawing up and communicating to the data subjects an information note regarding the processing of personal data;
- elaboration of internal procedures related to data protection and processing (e.g. data management policy of data subjects, data retention and deletion policy, control procedure for data protection; procedure for informing the Authority in case of a security incident , etc.);
- the inclusion in the contracts concluded by the Association of some clauses regarding the data protection;
- if there are surveillance cameras, it is mandatory to adopt procedures, respectively technical, organizational and security measures, appropriate for the protection of personal data collected through the video surveillance system, including in terms of integrating data protection principles (such as that of limited storage of records), the establishment of a limited number of persons having access to this system, the rights that can be allocated to each of them, the provision of clear processing instructions for persons processing data under the authority of the association, so so as to avoid access, dissemination or otherwise unauthorized processing of personal data processed through this system.
On the other hand, the management bodies of the Owners Association must understand that certain data and information must be presented to the members of the Association / condominium owners and CANNOT REFUSE THEIR DISCLOSURE on the grounds that "violates GDPR”. If a special law gives the owners the right to access certain information, that processing will be carried out legally, under that law. Thus, in order to make a little more transparent the association relationship (through management bodies) and its members or even non-member owners, Law 196/2018 on the establishment, organization and functioning of owners' associations and condominium administration helps this normal and logical process of transparency. Art. 28 of the Law stipulates that “The owners of the condominium (NN. Not only the members) have the right to be informed about all aspects regarding the activity of the association, to request in writing and to receive copies of any of its documents..”
Thus, the persons involved in these “complicated” co-ownership relations, especially those who have assumed the role of President / governing bodies of the Owners Association, must understand that the RGDP Regulation is an integral part of their activity, and ignoring the provisions. can affect the entire Association, because, in the end, the fine applied to financially affect all the owners of the condominium.
Av. Raluca Oancea
