Article 6(1) GDPR sets out the conditions that must be satisfied for the processing of personal data to be lawful. These are:
- Consent of the data subject;
- Necessary for the performance of a contract with the data subject or to take steps preparatory to such a contract;
- Necessary for compliance with a legal obligation;
- Necessary to protect the vital interests of a data subject or another person where the data subject is incapable of giving consent;
- Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Necessary for the purposes of legitimate interests.
Please visit: https://gdpr-info.eu/chapter-2/
In addition, the Romanian Data Protection Law states that processing data through IT or video surveillance systems in case of labour relations is allowed only under the following conditions:
- the legitimate interests of the employer are duly justified and prevail over the employees’ interests, rights and freedoms;
- the employer has fully and expressly informed its employees about the use of monitoring systems prior to the commencement of data processing;
- the employer has consulted the trade union(s) or the employees’ representatives about the introduction of monitoring systems prior to the commencement of data processing;
- less intrusive means were used and were proven not to be efficient; and
- the retention period for the personal data is proportionate with the processing purpose but no longer than 30 days, except for the situations expressly regulated or duly justified.