How To Run A DPIA When Increasing The Usage Of Surveillance Camera?

Whereas surveillance has become now an even hotter issue, the UK Data Protection Authority has published on 18 March 2020 an updated template of Data protection impact assessment for surveillance cameras.

This template is a useful tool for the organisations to conduct data protection impact assessments when using surveillance camera systems.

You may download the template at the link below:


In addition, the European Court of Human Rights has recently issued a new judgement on a personal data matter:

“case Gaughran v. the United Kingdom (application no. 45245/15) concerned a complaint about the indefinite retention of personal data (DNA profile, fingerprints and photograph) of a man who had a spent conviction for driving with excess alcohol in Northern Ireland.

The European Court of Human Rights held, unanimously, that there had been: a violation of Article 8 (right to respect for private and family life) of the European Convention on Human Rights.

The Court underlined that it was not the duration of the retention of data that had been decisive, but the absence of certain safeguards. In the applicant’s case his personal data had been retained indefinitely without consideration of the seriousness of his offence, the need for indefinite retention and without any real possibility of review.

Noting that the technology being used had been shown to be more sophisticated than that considered by the domestic courts in this case, particularly regarding storage and analysis of photographs, the Court considered that the retention of the applicant’s data had failed to strike a fair balance between the competing public and private interests.” (

Josh Holmes QC on Disclosure under the Damages Directive

The current situation triggered by Coronavirus does not prevent companies being held accountable for infringements of antitrust laws.
Therefore, this does not exclude potential claims for damages under the Damages Directive.

Josh Holmes QC is Barrister with Monckton Chambers in London, twice winner of the Competition/EU Junior of the Year award (in 2011/12 and 2013/14) and is recognised in Chambers UK and Legal 500 as a leader in European / Competition law and Telecommunications law.
Josh’s practice covers all aspects of competition, EU, public and regulatory work. He appears regularly in the UK Competition Appeal Tribunal, the High Court, and before the EU courts in Luxembourg. He defended Google against claims for damages by Streetmap alleging an abuse of dominance by Google in relation to search results.

In the context of Damages Directive, disclosure is important…

”Disclosure is important for standalone and follow-on claims alike, because of the often secret nature of competition law infringements: see preamble of the Damages Directive, recitals (14)-(15):

“Actions for damages for infringements of Union or national competition law typically require a complex factual and economic analysis. The evidence necessary to prove a claim for damages is often held exclusively by the opposing party or by third parties, and is not sufficiently known by, or accessible to, the claimant.

“Evidence is an important element for bringing actions for damages for infringement of Union or national competition law. However, as competition law litigation is characterised by an information asymmetry, it is appropriate to ensure that claimants are afforded the right to obtain the disclosure of evidence relevant to their claim, without it being necessary for them to specify individual items of evidence.”

… but proportionality is also important

Claimants often make extensive disclosure claims; they can be hugely burdensome and costly for Defendants, creating unfair pressure on Defendants to settle rather than incur costs they will never recover.

There is therefore a need to ensure that the disclosure ordered by national courts is proportionate.  See recital (16):

“National courts should be able, under their strict control, especially as regards the necessity and proportionality of disclosure measures, to order the disclosure of specified items of evidence or categories of evidence upon request of a party…  disclosure can be ordered only where a claimant has made a plausible assertion, on the basis of facts which are reasonably available to that claimant, that the claimant has suffered harm that was caused by the defendant… categories [of document] should be defined as precisely and narrowly as possible on the basis of reasonably available facts.”

Striking the balance : Article 5, Damages Dir.

NO FISHING EXPEDITIONS:  Art.5(1) = Member States shall ensure that a Claimant can obtain disclosure from a Defendant or third party.  Claimant must present “a reasoned justification to disclose relevant evidence which lies in their control”

EQUALITY OF ARMS: Art.5(1): Defendant may also obtain disclosure from Claimant

PROPORTIONALITY: Art.5(3): disclosure of evidence must be limited to what is proportionate, having regard to legitimate interests of all parties, and considering:

(a) Extent to which the claim or defence is supported by available facts or evidence;
(b) Scope and cost of disclosure, including preventing non-specific searches for information unlikely to be of relevance
(c) Need to protect confidential information

Need to protect confidential information

Disclosure materials will often be commercially sensitive

The Claimant will typically be a customer; and fellow Defendants will be competitors

Without protections, there is a risk of distorting the competitive process
Art.5(4) therefore provides that “Member States shall ensure that national courts have the power to order the disclosure of evidence containing confidential information where they consider it relevant to the action for damages.  Member States shall ensure that, when ordering the disclosure of such information, national courts have at their disclosure effective measures to protect such information”.

Examples of measures:
(1) confidentiality rings;
(2) in camera hearings;
(3) redaction of confidential material;
(4) use of indicative ranges in documents (including judgment)

Need to respect legal professional privilege

Documents relevant to a claim often contain legal advice

EU law recognises that documents containing legal advice by an external EU lawyer should be protected against disclosure

National systems of law may have broader concepts of LPP, e.g. UK law which includes internal lawyers.

Article 5(6) provides that “Member States shall ensure that national courts give full effect to applicable legal professional privilege under Union or national law when ordering the disclosure of evidence”.

Art.5 constitutes a floor and not a ceiling

National legal orders can provide for more extensive disclosure, provided that confidentiality is protected; those from whom disclosure is ordered have an opportunity to be heard before disclosure is given; and specific rules on disclosure of docs from files of a competition authority.

See Art.5(8): “Without prejudice to paragraphs 4 (confidentiality) and 7 (right to be heard) and to Article 6 (competition authority files), this Article shall not prevent Member States from maintaining or introducing rules which would lead to wider disclosure of evidence”.

E.g. pre-action disclosure rules.”

The quoted text is an except from Josh Holmes presentation during EMEA Conferences Sensitive Antitrust Issues Conference, 15 Nov 2017 Bucharest.

New Initiatives of the European Commission and the State Aid Schemes - interview with Diana Calciu

We discussed with Diana Calciu Senior Associate at Gide Brussels about the new initiatives of the European Commission in the context of the Coronavirus crisis and the state aid schemes.

Diana shared information on the following issues:

1. Which are the current initiatives proposed by the European Commission?

2. Which are the essential state aid related aspects in the context of the current state aid schemes that must be taken into account?

Please leave your comments and questions below and subscribe to our Youtube channel for more interviews on current important legal and business related topics.

COVID-19 - Obligatiile angajatorilor din perspectiva protectiei datelor - cu Costin Sandu, avocat

Am discutat cu Costin Sanduavocat specializat in materia protectiei datelor personale, despre obligatiile companiilor privind notele de informare catre angajati si analizele de impact pe protectia datelor in contextul de epidemiei COVID-19, cand multi oameni lucreaza de acasa si comunica extensiv online.

Costin a raspuns urmatoarelor intrebari:

1. Cum ar trebui modificata nota de informare catre angajati in contextul actual cand a crescut masiv numarul angajatilor care lucreaza de acasa si folosesc mijloace online?

2. Sunt necesare noi analize de impact asupra protectiei datelor (dpia-uri) (sau actualizari ale acestora) in conditiile in care un procent foarte mare de angajati lucreaza de la distanta?

3. Care sunt implicatiile din perspectiva protectiei datelor a atator meetinguri on-line care au loc acum?

Spune-ne parerea ta si lasa-ne intrebari in sectiunea de comentarii. Urmareste-ne canalul Youtube pentru mai multe interviuri pe subiecte juridice si de business de actualitate.

GDPR obligations during COVID-19. Interview with Jose Belo, Co-Chair of the IAPP Luxembourg Chapter

We have invited Jose Belo, Co-Chair of the IAPP Luxembourg Chapter, to clarify the new obligations of the employers in the current situations, when the majority of their employee work from home.

1. What are the new obligations that the employers must undertake under GDPR while the majority of their employees work remotely now?

2. What health data can an employer legally request its employees to provide him with?

3. Does the current situation trigger the modification of the DPIA, and if yes which are the aspects to be modified?

Please leave your comments and questions below and subscribe to our Youtube channel for more interviews on current important legal and business related topics.

GDPR si monitorizarea activitatii de la distanta a angajatilor - Interviu cu Roxana Ionescu, Partener NNDKP

Am invitat-o pe Roxana IonescuPartener la NNDKP si coordonator al practicii NNDKP de Protectia Datelor – sa ne clarifice obligatiile angajatorilor din perspectiva legislatiei privind protectia datelor in conditiile in care o mare parte dintre angajati isi desfasoara acum activitatea de la distanta.

Roxana a raspuns urmatoarelor intrebari rezultate din discutiile cu mai multe companii:

1. Ce obligatii are o companie pe legislatia vizand protectia datelor personale atunci cand monitorizeaza activitatea de la distanta a angajatilor sai?

2. In ce conditii poate managementul unei companii sa aiba acces in mod legal la emailurile angajatilor daca acestia nu sunt disponibili din motive medicale cauzate de coronavirus (sau orice alt motiv medical)?

3. Cum poate o companie sa asigure accesul angajatilor sai la date pentru ca acestia sa-si desfasoare activitatea de la distanta cu implicatii minime din perspectiva incalcarii securitatii datelor?

Spune-ne parerea ta si lasa-ne intrebari in sectiunea de comentarii. Urmareste-ne canalul de Youtube pentru mai multe interviuri de actualitate pe subiecte juridice si de business.

CO-VID19 , raporturile de munca & rolul Directorului de HR - Raluca Gadiuta, HP Romania

Am discutat cu Raluca Gadiuta – Director de HR de la HP Inc. Romania, despre impactul acestei perioade asupra raporturilor de munca si rolul Directorului de HR

Raluca ne-a raspuns la urmatoarele intrebari:

1. Cum se poate face coordonarea unui numar mare de angajati care lucreaza acum de la distanta?

2. Care sunt cele mai mari provocari pe care le are un Director de HR si cum pot fi depasite?

3. Cum crezi ca se vor schimba relatiile de munca dupa aceasta perioada si ce va fi diferit?

Spune-ne parerea ta si lasa-ne intrebari in sectiunea de comentarii. Urmareste-ne canalul de Youtube pentru mai multe interviuri de actualitate pe subiecte juridice si de business.

HR-ul în schimbare - Interviu cu Simona Șerban, HR Business Partner, eMAG

Am discutat cu Simona Șerban, HR Business Partner, Technology eMag & IT Fashion Days, despre rolul HR-ului în timpul epidemiei de COVID-19.

IMM-urile in vremea COVID-19. Directii de actiune - Interviu cu Adina Luca, consultant financiar, Profitable Insights UK

Raluca Nechimis de la EMEA Conferences a invitat-o pe Adina Lucaconsultant financiar la Profitable Insights – sa raspunda intrebarilor care ii preocupa cel mai mult pe antreprenori in aceasta perioada. Adina lucreaza pentru clienti din Marea Britanie, Canada, Polonia si Romania.

Din raspunsurile Adinei reies solutii si sugestii practice pentru activitatea de acum a antreprenorilor.

EMEA Conferences: Ce masuri ar trebui sa ia un IMM pentru a diminua/limita impactul acestei situatii asupra businessului sau?

Adina Luca: Masurile pe care ar trebui sa le ia un IMM, in ordinea prioritatilor, ar fi:

  • Cashflow (saptamanal actualizat) pentru perioada 1 aprilie – 1 iulie 2020 si sa aiba o idee despre cashflow si ce venituri ar putea avea in perioada iulie – decembrie pe scenarii (0%, 20% din ce ar fi avut normal, 50% din ce ar fi avut normal)
  • Sa controleze cheltuielile fixe de care nu beneficiaza si orice alte servicii prin abonament care nu isi mai au sensul
  • Sa incerce pe cat posibil sa isi tina oamenii printr-o forma de plata – calitatea de om a unui antreprenor acum se vede si daca esueaza acum, reputatia o sa sufere mai tarziu pentru ca oamenii nu uita
  • Sa inceapa un altfel de serviciu (de ex livrari online) doar dupa ce verifica cu cativa clienti importanti ca sunt dispusi sa cumpere – adica sa nu investeasca acum intr-o forma noua de livrare care reduce fondurile fara a avea insa siguranta ca piata o si doreste
  • Sa imprumute bani numai dupa ce a facut proiectia de cashflow si nu are nici o alta posibilitate – imprumutul de acum o sa aiba impact pe termen mediu si lung si va trage de el mult timp.

EMEA Conferences: Cum crezi ca pot face IMM-urile vanzari in perioada asta?

Adina Luca: Pentru a realiza vanzari in aceasta perioada, i-as spune unui antreprenor urmatoarele:

  • Tine legatura foarte strans cu clientii vechi si loiali si cei care erau aproape de contractare inainte de schimbare: mai este cazul? Si daca da, sub ce forma? Vor sa cumpere a) la fel; b) mai putin; c) la fel dar cu amanarea platii; d) o parte din serviciu pe gratis si o parte cu plata. Ofera-te sa ajuti, nu verifica daca mai cumpara, si vanzarea va veni. Asta este singura sursa de vanzare posibila in urmatoarele 12 saptamani din punctul meu de vedere. E si un test in ce masura ai reusit anterior sa dezvolti o relatie solida cu baza de clienti si o lectie pentru viitor.
  • Intreaba clientii vechi si loiali daca e o idee buna sa dezvolti un serviciu virtual si daca ar cumpara – daca toti spun ‘da’, atunci incearca un nou serviciu. Altfel, nu risca – daca cei vechi nu ar cumpara, de ce ar face-o cineva care n-a cumparat inainte? Stiu o firma care a mutat livrarea online pentru un serviciu mai redus, dar au facut-o dupa ce au intrebat clientii si clientii au raspuns pozitiv si au intrebat concret despre conditiile livrarii
  • Creste numarul de contacte in piata relevanta prin LinkedIn sau alte canale virtuale – dar nu incerca sa vinzi pentru ca in cel mai bun caz nu vor raspunde – de ce ar vorbi acum daca nu au vorbit inainte? Doar creeaza contactul in mod politicos. Cel mult ofera ceva pe gratis care este scurt si eficient si nu ii obliga la vreun angajament (webinar cu tips / solutii) dar selectiv – am vazut oferte de materiale virtuale care altfel ar fi fost cu plata.
  • Invata sa faci fata absentei fara sa te crizezi- ceea ce este foarte greu pentru un vanzator, care traieste pentru zgomot constant si daca nu e zgomot se panicheaza ca nu a facut suficient.

EMEA Conferences: Ce crezi ca este contraproductiv in abordarea vanzarilor in urmatoarele saptamani?

Adina Luca: Opinia mea este ca nu sunt productive urmatoarele abordari in vanzari in urmatoarea perioada:

  • Prezenta prea activa pe LinkedIn sau pe alte canale cu mesaje de vanzare sau webinarii si continut gratuit– demonstreaza ca nu ai altceva de facut si miroase a disperare si spune ca nu ai facut prea bine loializarea clientilor
  • Mesaje informale despre situatia disperata in care esti sau critice despre clienti care nu platesc/ autoritati / altii pentru a crea conversatii – toata lumea este intr-o situatie disperata. Clientii nu sunt activi pentru ca au ceva cu tine, se regrupeaza si daca nu stii ca se regrupeaza si cum inseamna, din nou, ca nu ai facut prea bine loializarea clientilor si nu ai acces la ei sa vezi in ce stare sunt. In privinta clientilor care profita de situatie sa nu mai plateasca – este o lectie pentru viitor, stii la cine o sa renunti mai tarziu, dar nu trebuie sa stie toata lumea.
  • In final – nu incerca sa te oferi expert in COVID-19 – nimeni nu este expert in COVID-19, este o situatie noua.

EMEA Conferences: Ce fac IMM-urile din Marea Britanie si ar putea fi implementat si de catre IMM-urile din Romania? Care e diferenta esentiala dintre ceea ce se intampla acum in Marea Britanie in ceea ce priveste IMM-urile fata de ceea ce se intampla in Romania?

Adina Luca: Poate ca IMM-urile din Marea Britanie fac chiar mai putin decat cele din Romania pentru ca in Romania toata lumea se tot pregateste de o noua criza inca din 2010 – pesimismul e mai mare si atunci, tot asteptand ‘criza’, cand vine esti mai pregatit decat optimistii, macar psihologic. In plus, in Marea Britanie, costurile sunt mult mai mari si profitabilitatea mult mai mica, deci ma astept sa dispara multe in cateva luni. Din nou, in Romania ma astept sa supravietuiasca si sa revina pe piata in partea a doua a anului.

In schimb mi se pare ca la nivel macroeconomic, mesajele sunt mai pozitive in Marea Britanie si guvernul este mai activ in a oferi suport – dar s-ar putea sa fie doar marketing, pentru ca daca te uiti in detaliu la conditiile de imprumuturi garantate sau suport pentru angajati in ‘concediu fara plata’, cer garantii personale si o bonitate financiara foarte mare pentru calificare.

Multe firme in Marea Britanie isi ofera serviciile gratuit ca sa nu stea degeaba si sa ramana in ‘atentia’ cumparatorilor in mod pozitiv. Suntem inundati cu oferte de webinarii, discutii, ajutor gratuit. Dupa parerea mea, e putin problematic sa oferi un serviciu gratuit pentru care un client vechi a platit luna trecuta. Aici cred ca trebuie sa exerciti multa judecata cand, cat si cui oferi.

In plus, in Marea Britanie este un val mare de voluntariat – multi dintre cei care au firme mici isi ofera serviciile pentru sistemul medical sau pentru comunitate in mod gratuit.

EMEA Conferences: Cum crezi ca va arata perioada imediat urmatoare incetarii acestei stari? Ce se va schimba in ceea ce priveste IMM-urile?

Adina Luca: Nu stiu daca o sa stim cum arata perioada de dupa decat retroactiv – o sa stim cum arata dupa ce a trecut. Dar din ce vad in jurul meu:

  • Pentru serviciile neesentiale daca piata nu a cumparat o perioada si a mers fara serviciul respectiv, probabil ca va continua asa. Nu inseamna ca isi descopera nevoia pe 1 iulie. De aceea am indicat scenariile de avarie de mai sus.
  • Probabil ca vechii clienti loiali vor continua sa cumpere ca si inainte, dar mai putin si mai precaut.
  • Depinde si daca serviciul este un serviciu de retentie – de exemplu contabilitatea. Contabilii vor continua cu baza lor de clienti in continuare. Serviciile de turism probabil ca vor trebui sa astepte pana in 2021 pentru revenirea increderii in siguranta calatoriilor.

Multumim Adinei pentru sugestiile ei. Speram ca multi dintre cei care citesc aceste sugestii le vor aplica.

How do we determine the UBO in the case of a listed company?

According to Alina Radu, Partner NNDKP – speaker at our event “Sensitive Compliance and AML Issues and Solutions” on 27 February 2020 – “the principle to be followed when determining the UBO of a Romanian company is that the UBO is the natural person who ultimately owns or controls the Romanian company (art. 4 para.1 of Law 129/2019). An assessment shall be done on a case by case basis to determine the UBO.

In light of the above principle, based on the current wording of Law 129/2019, in case of a Romanian company which has the last entity in the controlling chain a company listed on a regulated market, it needs to be determined, on a case by case basis, whether there is a natural person/natural persons acting in concert who “actually” own or control such entity. Companies listed on a regulated market are subject to clear transparency and corporate governance rules, which makes the verification easier.

According to the current wording of Law 129/2019 (art. 4 para. 2 (a) (1) in correlation with art. 19 which makes no exception for listed companies or companies owned by listed companies), if a natural person indirectly owns more than 25% of the shares of the Romanian company, it could be considered that at least such person needs to be disclosed as UBO.

If no such natural person holds indirectly more than 25% of the shares/voting rights, and there is no other person ultimately exercising control over the Romanian entity, then according to the current wording of art. 4 para. 2 (a) (2) of Law 129/2019), the management of the Romanian entity is to be declared as UBO. The key question here is whether it can be considered that the natural persons acting as representatives of the direct or indirect shareholder(s) of the Romanian entity (including those of the listed company) which take shareholders’ decisions to be implemented by the Romanian entity should or not be declared as UBO for the purpose of Law 129/2019. This requires assessment by each company to determine whether they fulfill the “control” criteria to declare an UBO under para. 4 (1) correlated with para. 4 (2) (a) (1) – para. (2) sets examples and it is not exhaustive (it says “at least”) !

When talking about listed companies, attention should be paid as Law 129/2019 refers in art. 4 para. 2 (a) (1) to companies whose shares are traded on regulated markets and not to a more general concept of “listed” companies. In Romania, for example, companies whose shares are traded on Aero – the alternative trading system – would not fall within the concept of companies whose shares are traded on regulated markets (only those traded on the main market of BVB would qualify if we are talking about the Romanian market).

The clarification of the treatment of listed companies, as well as guidelines from the relevant authorities on these aspects will be welcome.”