skip to content
 

Data Protection Laws and Freedom of Expression: RomaniaFile:Flag of Romania.svg

 

 

I. First -Generation Statutory Law

Romania did not adopt any data protection statute during the first-generation period. 
 

II. Second-Generation Statutory Law

Law No. 677/2011 on the Protection of Individuals with Regard to the Processing of Personal Data and the Free Movement of Such Data was adopted in 2001. At that time, Romania was not a member of the European Union yet, which it only joined on 1 January 2007.
 
Special Expression Derogation
Romanian law provided for minimal derogation from data protection provisions for processing carried out for exclusively journalistic, literary or artistic purposes. Data quality principles as well as proactive transparency rules applied without restrictions. The proactive transparency rule applicable to cases of indirect collection of data was subject to rule-bound exemptions. Romanian law accordingly provided an exemption only where enforcement ‘might reveal the source of the information’ (Law No. 677/2011, art. 12(3)). Similarly, the retroactive transparency rule could only be derogated from for the protection of the confidentiality of the source of information held by journalists (ibid, art. 13(6)). Sensitive information rules applied to the media unless the data were manifestly made public by the data subject or were closely related to the quality of the person as a public figure or the public nature of the facts involved (ibid, art. 11). The exemption from the legitimating ground condition is only available if certain specific circumstances or rules are satisfied, that is, in so far as data is ‘manifestly made public by the data subject or are closely related to the public figure quality of the personal concerned or the public nature of the facts involved’ (ibid, art 11). No special provision was provided for with regard to requirement to notify processing to the Data Protection Authority. The international data transfer condition’s applicability depended on whether ‘the data were made public expressly by the data subject or are related to the data subject’s public quality or to the public character of the facts he/she is involved in’ (ibid, art. 29(6)).
 
Broad Expression Derogation
There was no relevant provision.
 
Personal Exemption
The Romanian Data Protection Act did not apply to personal data processing, carried out by natural persons exclusively for their use but expressly only if the data in question was not intended to be disclosed (ibid, art. 2(6)).
 
Knowledge Facilitation Framework
Pursuant to the Romanian Data Protection Act, the further processing of personal data for statistical, historical or scientific research was not considered incompatible with the purpose for which they were initially collected, if this was carried out according to the provisions of the Act, including those referring to the notification submitted to the supervisory authority, as well as according to the guarantees regarding personal data processing set out by the relevant legal provisions on statistical activity or the historical or scientific research (ibid at. 4(1)(b)). No exemption for knowledge facilitation purposes was granted from the proactive direct transparency rule. In contrast, a full exemption was provided from the proactive indirect transparency rule on the basis of disproportionate effort, if the processing of data was carried out for ‘statistical, historical or scientific research, or in any other situation’ (ibid, art. 12(4)). Moreover, a very narrow exemption was provided from the reactive transparency rule (subject access) for the processing of health data for scientific purposes (ibid, art. 13(5)). There were no exemptions from the sensitive data restrictions, although there was a provision authorising the processing of health data where necessary for the protection of public health where this processing had obtained preliminarily authorized by the supervisory authority and was performed by medical staff who were under a pledge of professional confidentiality (ibid art. 9). No exemptions were provided from the international data transfer, notification and legitimating ground conditions.
Parliamentary Debates
Special Expression Derogation
In its Explanatory Memorandum of 21 March 2001 on the proposed Data Protection Act, the Romanian Government explained that some of the individual rights provided for therein may be subject to limitations if personal data is processed for journalistic, literary or artistic purposes. The Legislative Council’s Recommendations (Aviz 173/01.03.2021) recommended that an ‘equilibrium between freedom of expression and the protection of privacy’ would have to be sought. The proposed Art. 26 on the ‘norms of conduct for journalists’ was, however, criticized in by the Legislative Council for its leniency, allowing for the ‘unfettered freedom’ to process personal data for journalistic, literary or artistic purposes. The Senate, which was the first chamber debating the proposed Data Protection Act, suggested under the heading of ‘norms of conduct of journalists’ that the supervising authority should adopt codes of conduct regulating the appropriate protection of personal data in the journalistic context. As the result of an amendment proposed by Commission for Information Technology and Communications (CITC) in its ‘Replacing Report’ (Nr. XVIII/23/55, 24.08.2001), the Chamber of Deputies later proposed to drop the reference to journalism in the heading, encouraging ‘professional associations’ rather than merely ‘journalistic associations’ to adopt norms of conduct with regard to the processing of personal data. This version of the article was eventually adopted without debate.
 
Broad Expression Derogation
There were no relevant debates.
 
Personal Exemption
There were no relevant debates.
 
Knowledge Facilitation Framework
The Commission for Information Technology and Communications in its ‘Replacing Report’ (Nr. XVIII/23/55, 24.08.2001),[1] proposed amending the Government’s initial draft on the compatibility of data processing for statistical, historical or scientific research with the purpose the respective data were initially collected for stating that such compatibility was conditional on the compliance with the rules ‘referring to the notification submitted to the supervisory authority, as well as according to the guarantees regarding personal data processing, set out by the legal provisions on statistical activity or historical or scientific research’. The Commission argued that such an amendment would bring the proposed Act more in line with the Directive. The Commission, moreover, proposed amending art 5(2)(g) on the requirement of the data subject’s consent by clarifying that data should remain anonymous ‘throughout the entire processing’. In contrast to the governmental draft, it also proposed to introduce a notification requirement for the processing of personal data for statistical purposes and for historical or scientific research consisting of the purpose justifying the processing of personal data. These proposed amendments were adopted without debate.  
 

III. Third-Generation Statutory Law

Law No. 190/2018 on Implementing Measures to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such data and Repealing Directive 95/46/EC (General Data Protection Regulation) was adopted in 2018.
 
Special Expression Derogation
Romania provides for an exemption from potentially all of the substantive data protection which depends on certain pre-defined restrictive conditions being met. In sum, a derogation can only apply where the personal data ‘were manifestly made public by the data subject themselves or related to the public nature of the data subject or of the facts in which they are involved’ (Law No. 190/2018, art. 7).  This special expression provision explicitly establishes its priority over the knowledge facilitation framework.
 
Broad Expression
There is no relevant provision.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Article 8 of Law No.190/2018 exempts the processing for archiving purposes in the public interest and also scientific or historical research purposes from Arts. 15 (access rights of the data subject), 16 (right to rectification) and 18 (right to restriction of processing) GDPR and for public interest archiving purposes from Arts. 15-16 and 18-21 (right to restriction of processing, notification requirement, right to data portability, and right to object to the processing of personal data) GDPR. All derogations are, however, subject to three conditions: (i) compliance with the listed GDPR provisions must render it impossible or seriously affect the achievement of the specific purpose; (ii) such derogations must be necessary to achieve the specific purpose; and (iii) the appropriate safeguards provided for in Art. 89 GDPR must be complied with.  No other special provisions are set including any legal basis for processing sensitive data or criminal-related data as defined in Article 9(1) and Article 10 GDPR.
Parliamentary Debates
Special Expression Derogation
Other than restating the proposed provision[2] and expressing the need to balance data protection and the right to freedom of expression[3], the relationship between journalistic, artistic or literary expression and data protection were not discussed in the legislative process.
 
Broad Expression Derogation
No relevant debates were recorded.
 
Knowledge Facilitation Framework
As for the special expression derogation, the provisions relating to knowledge facilitation derogations were restated but not substantively discussed.[4] 
 

[1] Nr. XVIII/23/55, 24. August 2001; available at http://www.cdep.ro/comisii/tehnologia_informatiei/pdf/2001/rp292.pdf (last accessed 18 April 2021).
[2] See Parlamentul României Camera Deputatilor, ‘Aviz: Comisia pentru tehnologia informatiei si communicatiilor’ (26 March 2018) PLx nr. 167/2018, p. 4.
[3] Ibid, p. 3.
[4] Ibid, p. 4.