TB – 10037/2025

26 January 2026

Dt:

{{COURTdecisionBOX

|Case_Number_Name=10037/2025
|ECLI=

|Date_Decided=10.12.2025
|Date_Published=
|Year=2025

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|Initial_Contributor=
|
}}

A court found that the DPA failed to provide a concrete description of the unlawful actions of the controller and annulled the DPA’s decision against the controller regarding illegal video surveillance.

== English Summary ==

=== Facts ===
The Romanian DPA issued a fine to a company (the controller) in April 2025 for the unlawful processing of its employees’ personal data via surveillance cameras in one of its storage facilities in violation of Article 5(1)(a) and (b) GDPR, [[Article 5 GDPR#2|Article 5(2) GDPR]], [[Article 6 GDPR#1|Article 6(1) GDPR]], and Article 5 Law no. 190/2018 (Legea nr. 190/2018).

The controller appealed the DPA’s decision in court arguing, among other things, that the DPA failed to indicate the specific violation committed and the specific time and date. The controller asked the court to annul the DPA’s decision.

=== Holding ===
The court found that the DPA failed to provide a concrete description of the violations committed by the controller. The court noted that the DPA’s decision only provided a generic mention that the personal data processing activities carried out by the controller were in breach of Article 5(1)(a) and (b) GDPR, [[Article 5 GDPR#2|Article 5(2) GDPR]] and [[Article 6 GDPR#1|Article 6(1) GDPR]] along with Article 5 Law nr. 190/2018.

Furthermore, the court found that the DPA’s decision failed to identify and mention the exact date and context of the alleged unlawful processing activities. Instead, the decision only specified that the processing began in 2017.

Therefore, the court upheld the controller’s appeal against the DPA’s decision and annulled said decision.

== Comment ==
”Share your comments here!”

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

<pre>
########
BUCHAREST COURT
SECTION II
ADMINISTRATIVE AND TAX LITIGATION

File no. #####/3/2025
ECLI:RO:TBBUC:2025:007.######

Civil judgment no. ##### dated December 10, 2025

The court is composed of:
President – ######## #####
Clerk – ######-#### Rencuzogullari

The case concerning the plaintiff ########## S.R.L. in conflict with the defendant the National Supervisory Authority for the Processing of Personal Data with ######## (ANSPDCP) is pending, having as its object the annulment of an administrative act.
The debates of the case took place in the hearing on 25.11.2025, being recorded in the conclusion of the hearing of that date, a conclusion that is an integral part of this decision, when the court, needing time to deliberate, pursuant to art. 396 paragraph 1 of the republished Code of Civil Procedure (hereinafter C.p.c.), postponed the ruling in the case to 10.12.2025, when – in the same composition – decided the following:

THE COURT

Deliberating on the present civil case, finds the following:
By the application registered on the docket of the Second Administrative and Fiscal Contentious Section of the Bucharest Court on 28.04.2025, the plaintiff filed a counterclaim with the defendant, pursuant to art. 17 paragraph 1 of Law no. 102/2005, against the minutes of contravention no. 6802/02.04.2025 issued by the defendant institution, requesting the annulment of the report and, in the alternative, the replacement of the fine sanction with a warning, along with the obligation of the defendant to pay the court costs.
In its reasoning, the plaintiff indicated that the report is invalid for not indicating the act committed and the date of its commission and the failure to clearly indicate the complementary sanction/corrective measure ordered, as well as that the operator is free to establish its security measures, according to the principle of proportionality and good faith.
It detailed the applicable CJEU case law and indicated that the principle of necessity is applicable, the use of video recordings being the least intrusive way to achieve the result in relation to its efficiency; the checks were also carried out in the interest of the employee concerned, who was ultimately not sanctioned.
It was added that the report was drawn up in the absence of a complete investigative procedure, with the impossibility of anticipating the sanction, since the plaintiff had no way of intuiting the aspects that the defendant considered insufficiently explained, justified or proven, in the absence of clear requests in this regard from the defendant.
The plaintiff argued that it was wrongly recorded that art. 5 of Law no. 190/2018 was not complied with, since the requirements of this article were met by the plaintiff. It was added that the warning measure can be ordered if the facts are of low gravity, as in the present case, in which there is no social danger.
In law, she invoked art. 14, art. 15, art. 17 paragraph 1 of Law no. 102/2005, art. 28 paragraph 1 of the Procedure for conducting investigations approved by Decision no. ###/2018 of the President of the ANSPDCP, O.G. no. 2/2001, art. 5, art. 6, art. 24, art. 25 of the GDPR, art. 6 ####, art. 4 of Protocol 7 #### and art. 50 of the Charter of Fundamental Rights of the EU, requesting proof with the attached documents.
The application was legally stamped with a judicial stamp fee of 20 lei (tab 5 vol. I).
The defendant filed a response (tab 185 vol. I) requesting the rejection of the application as unfounded, showing the factual situation by reproducing the contested minutes (also reproduced by the court below) and citing art. 4 point 2, art. 4 point 7, recital (74), recital (75), art. 5, recital (39) of the GDPR, art. 6 para. (1), recital (47), art. 58 para. (2) and art. 83 of Regulation (EU) 2016/679 (RGPD), together with art. 12 of Law no. 190/2018 and art. 14 – art. 16 of Law no. 102/2005.
It stated that the applicant’s arguments are unfounded and the minutes are legally and thoroughly drawn up, stating that the applicant has not presented evidence showing that the purpose of the image processing is justified and that other less intrusive means were used to achieve this purpose and which had not proven their effectiveness prior to the decision, that the applicant operator has not presented evidence showing that it has met all the conditions provided for in art. 5 of Law no. 190/2018 and that the description of the contravention was made indicating the date, time and place where it was committed, as well as showing the circumstances that can serve to assess the seriousness of the act and to evaluate the possible damages caused; the act was described in detail under the heading “we have found the following”.
It was added that the contravention committed by the plaintiff is continuous and not a simple contravention, which has as its initial moment the date of 11.09.2017 and which took place until the date of its commission being established by the contested report, respectively the date of its conclusion 02.04.2025. It was found that the plaintiff did not prove the occurrence of any injury.
She requested documentary evidence and the trial of the case in absentia.
The plaintiff filed a response to the objection (page 144, vol. II) in which she requested the rejection of the defendant’s defenses, essentially reiterating the arguments from the main application.
The court administered documentary evidence in the case.
Analyzing the documents in the file, in light of the legal provisions in the matter, the court notes the following:
In fact, by the report of contravention no. 6802/02.04.2025 issued by the defendant institution through counsels ###### #######-###### and ########## #######-#### (tab 22 vol. II) the following was found:
“Through petitions no. 8467/01.05.2024 and no. 8468/01.05. 2024 a petitioner complains that on April 27, 2024 an employee of ########## SRL unauthorizedly accessed the video surveillance system and subsequently used the video recordings of the employees of the Decathlon warehouse in Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ##, by extracting the images through external storage media.
At the same time, through petition no. 8470/02.05.2024 a petitioner complains that the lawyer ###### ##### (partner lawyer of ########## SRL) requested by phone to send the sick leave of one of the Roumasport employees via an e-mail address. Following the telephone request, the document was sent and the respective employee was also informed about the disclosure of his sick leave.
#### of the above, pursuant to art. 57 and art. 58 of the GDPR and art. 14 et seq. of Law no. 102/2005, republished, by address no. 9471/20.05.2024, ANSPDCP requested ########## SRL (Roumasport/Decathlon) to send information regarding the following aspects:
•the purpose and date of installation of the video surveillance cameras, as well as the legal basis for processing data through them;
•what is the number of video surveillance cameras installed, their type, fixed or mobile, the positioning of each camera in relation to the specific objective pursued, from the location in Ilfov County, Ștefăneștii Village of Jos, Commune of Ștefăneștii de Jos, #### ###### ### ##;
•where the monitor(s) on which images captured by the surveillance cameras can be viewed are installed;
•whether the video surveillance means allow for the enlargement of images or their modification, as well as whether there is the possibility of capturing sounds;
•the number of data subjects (including employees) whose data are processed through this surveillance system;
•whether in the operation of the video surveillance system you use the services of third parties (authorized persons within the meaning of the GDPR); if so, please send us a copy of the contract(s) concluded with them;
•the manner in which data subjects are informed, in accordance with the legal provisions in force, before accessing the video surveillance system and subsequently using the video recordings of employees from 27.04.2024; please attach evidence;
•whether warnings are posted regarding the video surveillance through the installed system; if so, at what distance are these positioned from the places where they are located video cameras; please attach evidence;
•whether the images taken are stored and for what period of time, as well as what is the subsequent destination of the processed data (e.g. destroyed, deleted);
•whether the images taken by the video cameras are disclosed to recipients and, if so, who are the recipients or categories of recipients of this data;
•who were the persons designated to have access to the video surveillance system, as well as the documents on the basis of which such powers were established for them – before accessing the video surveillance system and subsequently using the video recordings of the employees from 27.04.2024; please attach evidence;
•whether the security requirements provided for by the legal provisions in force are complied with, and you will send us a copy of the documents by which the measures were adopted to ensure data security;
•whether you have had requests addressed to date regarding the exercise of the rights of the data subjects, as well as their resolution method;
•the legal basis for installing surveillance cameras at the place of work;
•how was the prior consultation of employees carried out, before the installation and commissioning of the video surveillance system; please attach supporting documents;
•the circumstances / circumstances in which the video surveillance system was accessed and the subsequent use of the video recordings for the purpose of sanctioning the employee/employees of your company, the purpose and legal basis.
At the same time, ANSPDCP requested Roumasport and any other information it considers relevant for clarifying the case related to the incident that occurred on April 27, 2024 in the Decathlon warehouse in Ilfov County, Ştefăneștii de Jos Village, Ştefăneștii de Jos Commune, #### ###### ### ##.
Regarding notification no. 8470/02.05.2024, ANSPDCP requested Roumasport to send us information on the following aspects:
1. considering that health data are special categories of personal data, we therefore request that you send us the legal basis according to art. 6 of the GDPR regarding the disclosure by transmission of the medical leave of Mr. ####### ###########;
2. regarding the processing by disclosure of the data regarding the health status of Mr. ####### ###########, we request that you specify the conditions applicable to this processing in relation to the provisions of art. 9 of the GDPR;
3. the purpose of disclosing the medical leave to Ms. lawyer and other documents belonging to Mr. ####### ###########, as the case may be;
4. considering the disclosure of medical data via the e-mail address to the lawyer, we request that you send us the security measures, according to art. 32 of the GDPR, with the attachment of evidence, as appropriate;
5. list the personal data and documents that were sent to Ms. lawyer following her requests dated April 25. 2024;
6. the contract or any other legal act concluded between the company and Ms. lawyer ###### #######.
We also ask you to send us the procedures implemented at the company level, existing before the incidents relating to the two cases detailed above.
########## SRL responded by addresses no. 89/05.06.2024 and annexes, registered at the authority’s registry under no. 10686/06.06.2024 and no. 11394/14.06.2024:
“###### in view of your address no. ##########.05.2024 by which you requested the communication of information regarding 2 notifications received by ANSPDCP, the first in relation to accessing the video surveillance system located in the Decathlon warehouse in Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ##, and the second in relation to the transmission of information regarding sick leave to a company lawyer, we hereby inform you of the following:
First of all, we note that the undersigned has not authorized any person to file complaints/notifications with ANSPDCP. We note that there is no legal authorization or special power of attorney for the filing of complaints/notifications on behalf of the undersigned with ANSPDCP. Therefore, the undersigned does not take ownership of these complaints/notifications and please take note of the fact that we we withdraw the complaints/notifications if they were made on behalf of ########## S.R.L.
If the complaints/notifications were made in our own name and not on behalf of the company ########## S.R.L., and they cannot be withdrawn, we provide you with the following information regarding the questions asked.
I. Access to the video surveillance system located in the Decathlon warehouse in Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ##
1. Purpose and date of installation of video surveillance cameras, as well as the legal basis for processing data through them;
The undersigned processes the personal data of employees and other persons through video surveillance cameras to ensure the security of employees and their property, the security of the company’s products, the security of customers and visitors in the Decathlon space.
The undersigned also processes the data for the purpose of preventing the commission of crimes, for the purpose of proving certain facts or incidents in Decathlon stores/premises, such as, for example, the theft of products and to fulfill the legal obligations to have a video surveillance system and to make video recordings available to judicial bodies. In certain situations, the data processed through surveillance cameras may be used for the purpose of conducting disciplinary investigations or in anticipation of conducting disciplinary investigations in accordance with the provisions of the law, in order to prove certain facts in which a specific employee may be involved.
We note that the purposes of processing personal data are mentioned in the Privacy Policies regarding the processing of personal data through Decathlon video surveillance systems. We attach the Privacy Policy regarding the processing of personal data through Decathlon video surveillance systems for employees (Annex 1) and the Privacy Policy regarding the processing of personal data through Decathlon video surveillance systems for customers and visitors (Annex 2).
Regarding the date of installation of the video surveillance cameras, they were installed on 11.09.2017, with the opening of the Decathlon warehouse work point in Ilfov County, Ştefăneștii de Jos Village, Ştefăneștii de Jos Commune, #### ###### ### ##.
Regarding the legal basis for data processing through video surveillance cameras, the undersigned processes personal data in order to fulfill a legal obligation, according to art. 6 para. 1 letter c of Regulation ####### on Data Protection no. 679/2016 (“RGPD”). ######### the legal basis for having a video surveillance system in the Decathlon warehouse is provided by the provisions of Law no. 333/2003 on the guarding of objectives, goods, values and the protection of persons republished in conjunction with the provisions of Decision no. 301/2012 for the approval of the Methodological Norms for the application of Law no. 333/2003 on the security of objects, goods, values and the protection of persons.
Also, personal data are processed based on the legitimate interests of the company to possess evidence in the event of thefts, acts of violence or other illegal acts committed by customers, employees or other persons.
At the same time, personal data processed through the video surveillance system may be used for the purpose of conducting disciplinary investigations or in anticipation of conducting disciplinary investigations, based on the legitimate interest of the company to make correct decisions within the framework of disciplinary investigations, to protect employees against abuses or illegal disciplinary sanctions and to avoid possible appeals regarding sanctioning decisions as a result of conducting incomplete or incorrect disciplinary investigations.
Information on the legal basis for data processing is mentioned in the 2 privacy policies that are part of Annex 1 and Annex 2 to this response address.
2.#### is the number of video surveillance cameras installed, their type, fixed or mobile, the positioning of each camera in relation to the specific objective pursued, from the location in Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ##;
The following types of cameras are installed within the Decathlon warehouse work point:

In total, within the Decathlon warehouse work point in the location Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ## are installed 86 video surveillance cameras.
We attach an extract from the Technical Security System Project (Annex 3) which contains a sketch of the ground floor and mezzanine of the Decathlon warehouse and the positioning of each camera in relation to the monitored objective. In the lower right part of the sketch, in the ####### section, the symbols for each type of camera are entered.
We note that these cameras are located in the exterior area, the perimeter area, the access areas, the security equipment area, the storage area and the goods transfer and reception area.
As shown in the extract of the Technical Security System Project (Annex 3), the surveillance cameras are positioned with respect to the specific objective pursued as follows:
• IP bullet cameras and IP dome cameras (63 cameras) – Fixed cameras – cover both the interior and exterior areas. The areas covered are – the perimeter area, the access areas, the security equipment area, the storage area and the goods transfer and reception area;
• IP speed dome cameras (5 cameras) – Mobile cameras – cover only the exterior area. The areas covered are – the perimeter area;
• IP fisheye cameras (7 cameras) – Fixed cameras – cover only the interior area. The areas covered are – the storage area and the goods transfer and reception area;
• Panoramic IP video cameras (2 cameras) – Fixed cameras – cover only the interior area. The areas covered are – the transfer and goods reception area;
• LPR IP video cameras (2 cameras) – Fixed cameras – cover only the exterior area. The areas covered are – the access area;
• Thermal IP video cameras (6 cameras) – Fixed cameras – cover only the exterior area. The areas covered are – the perimeter area.
• Rail IP video camera – (1 camera) – Mobile camera – cover only the interior area. The areas covered are – the storage area.
3. Where is the monitor/monitors installed on which images captured by the surveillance cameras can be viewed;
The images recorded by the surveillance cameras within the Decathlon warehouse are displayed on 3 monitors.
One monitor is located in the room where the company’s IT equipment is located within the Decathlon warehouse work point. This monitor displays images recorded by all the surveillance cameras in the Decathlon warehouse.
A second monitor is located in the security guard’s cabin. ###### The security guard’s cabin is located outside, at the entrance to the Decathlon warehouse’s exterior area accessible to trucks carrying goods. This monitor displays images recorded by the surveillance cameras located outside the Decathlon warehouse, as well as images recorded by the surveillance camera located inside, at the main entrance to the Decathlon warehouse building. These images are displayed on the security guard’s monitor, given that security at the Decathlon warehouse is provided 24/7. The security guard can only view live images, not past recordings.
The third monitor is located at the reception desk at the main entrance to the Decathlon warehouse. This monitor displays images captured by an indoor camera that captures images from the reception desk, images captured by an outdoor camera that captures images from the outside and the sports field, and images captured by 2 outdoor cameras that capture images from the barrier and the main entrance alley from the outside. ######## at the reception desk can only view live images on this monitor, not past recordings.
4.#### video surveillance equipment allows images to be enlarged or modified, as well as the possibility of capturing sounds;
Video surveillance equipment allows images to be enlarged (Zoom function) and does not capture sound. Video surveillance equipment does not allow images to be modified directly, and image modification if necessary (for example, blurring) is carried out with the help of the company’s IT Department, using specific software.
5. Number of data subjects (including employees) whose data are processed through this surveillance system;
Number of persons whose personal data are processed through the video surveillance system within the Decathlon warehouse is approximately 100-200 persons daily, depending on the number of employees working in shifts, their working hours and the distribution of the working hours by day.
6.#### in the operation of the video surveillance system you use the services of third parties (persons authorized within the meaning of the GDPR); if so, please send us a copy of the contract(s) concluded with them;
The company ###### ###### ####### SRL, which provides maintenance and repair services for video surveillance systems, is the only person authorized within the meaning of the GDPR who can process personal data recorded through video surveillance. We attach the additional act on the processing of personal data concluded between ########## SRL and ###### ######## ####### SRL (Annex 4).
7. The manner of informing the data subjects, according to the legal provisions in force, before accessing the video surveillance system and subsequently using the video recordings of employees dated 27.04.2024; please attach evidence;
The data subjects (employees) are informed about the access, use and processing of personal data through the Privacy Policy on the processing of personal data through Decathlon video surveillance systems (Annex 1).
This policy is communicated to employees through several communication channels, to ensure the principle of transparency provided for by the GDPR. The policy is brought to the attention of employees as follows:
•Upon hiring, by making the Privacy Policy on the processing of personal data through Decathlon video surveillance systems available to employees and having employees sign a declaration of acknowledgement of the policy. This process is ensured by having employees sign a document upon hiring, called a Declaration on their own responsibility. Within the document, in section 11, the “Privacy Policy for employees regarding the processing of personal data through video surveillance systems” is expressly mentioned and the fact that it has been brought to the attention of employees. We attach a model of the Declaration on your own responsibility document (Annex 5);
•The policy was communicated to employees by email, the latest version of the policy being communicated to employees by email on 14.12.2023. We attach evidence in this regard (Annex 6);
•The policy is displayed on the Intranet (the company’s internal computer network where the most important information for Decathlon employees is published). Employees can consult the Intranet network at any time. We attach a screenshot with proof of the display of the policy on the Intranet network (Annex 7);
•The policy is displayed on the employee noticeboard in all Decathlon workplaces. The employee noticeboard is an information board accessible only to employees at the workplace, where the most important information for employees is communicated in physical format. We attach 2 photos taken of the employee noticeboard in the Decathlon warehouse in Ilfov County, Ștefăneștii de Jos Village, Ștefăneștii de Jos Commune, #### ###### ### ## (Annex 8);
•The policy is brought to the attention of employees through the mandatory periodic training for Decathlon employees. We attach an excerpt from the training during which we inform employees about the company’s policies (Annex 9).
8.#### are warnings posted regarding video surveillance through the installed system; if so, how far are they positioned from the places where the video cameras are located; please attach evidence;
Warnings regarding video surveillance are displayed so that anyone accessing the Decathlon outdoor or indoor space is informed of the video monitoring in these spaces.
Warnings regarding video surveillance are displayed both at the 2 entrances to the Decathlon warehouse exterior and at the 2 entrances to the Decathlon warehouse building.
Warnings displayed at the 2 entrances to the Decathlon warehouse exterior (street entrances) are displayed on the gates that allow access to the Decathlon warehouse yard.
Warnings displayed at the 2 entrances to the Decathlon warehouse building are displayed on the access doors to the building.
Warnings are also displayed on the security guard booth located at the exterior entrance, accessible to trucks carrying goods.
We attach photos of all the locations where warnings regarding video surveillance are placed, as mentioned above (Annex 10).
Regarding their positioning in relation to the places where the video cameras are located, we attach an extract from the Technical Security System Project containing the sketch of the video surveillance cameras, in which we marked the location of the warnings regarding video surveillance (Annex 11). The sketch shows the locations of the cameras and warnings and the fact that any person accessing the exterior or interior of the Decathlon warehouse is informed about the video monitoring through these warnings.
9.#### The images taken are stored and for what period of time, as well as what is the subsequent destination of the processed data (e.g. destroyed, deleted);
The images are stored for a maximum period of 30 days if no incidents occur, upon expiration of the term the images are automatically deleted by overwriting. In the event of incidents, such as accidents or thefts, the images are stored throughout the administrative and/or litigious procedures.
10.#### The images taken by the video cameras are disclosed to recipients and, if so, who are the recipients or categories of recipients of these data;
The images taken by the video cameras can be accessed by authorized Decathlon employees, in accordance with internal procedures. These are the Director of the work point, the Deputy Director, the Director of the day (the employee responsible for the security of the work point) and the employee responsible for the management of the personnel at the work point. The images can also be transmitted to the National Director of Operations, to the Company Administrator or to employees who are part of the disciplinary investigation committees, for the purpose of carrying out a prior disciplinary investigation, in accordance with the provisions of the Labor Code.
Other recipients of the data:
•###### ######## ####### SRL – the company that ensures the maintenance and repair of the video surveillance system;
•R.O SRL Security Company – the company that provides security guards;
•Insurance companies or certain consultants (e.g. lawyers for providing legal opinions);
•Police authorities at their request or in the event of filing complaints;
•#### public authorities, according to the obligations provided by law.
11.#### were the persons designated to have access to the video surveillance system, as well as the documents on the basis of which such powers were established – before accessing the video surveillance system and subsequently using the video recordings of employees from 27.04.2024; please attach evidence;
According to Decathlon’s internal procedures, access to the video surveillance system is limited to the minimum number of persons necessary for the company’s activity. Access and use of images recorded by the video surveillance system are allowed only to certain persons, depending on the purpose of processing personal data.
In order to respond to requests received from the police, the images are consulted and transmitted to the police by the Deputy Director and the Director of the Day (the employee responsible for the security of the workplace), according to a procedure for providing video images to the police (Annex 12).
The Deputy Director and the Director of the Day will also consult the video images in the event of accidents involving customers, employees, visitors or providers or in the event of exceptional situations such as fire, theft, armed robbery or other situations that may endanger the safety of people or property.
According to the duties of the Deputy Director and the Director of the Day, they will not consult the video images for the purpose of monitoring the behavior of employees, for example to check whether employees are fulfilling their duties, how much time they spend on breaks, if they are late for work or if they have committed various crimes or disciplinary offenses. The images can be consulted for the purpose of monitoring employee behavior only by the Director of the work point or the employee responsible for personnel management at the work point. We attach an extract from the internal procedure that establishes the duties of the Director of the work point, the Deputy Director, the Director of the day and the employee responsible for personnel management (Annex 13).
The images will be accessed by the Director of the workplace and by the employee responsible for the management of the personnel at the workplace for the purpose of monitoring the behavior of employees in accordance with the internal procedure for conducting disciplinary investigations. This procedure contains instructions on accessing the CCTV system for the purpose of monitoring the behavior of employees with the purpose of ensuring compliance with the principle of data minimization, protecting employees from possible abuses and protecting the rights and freedoms of employees in the field of data protection.
These instructions have been introduced in section 12 of the Data Protection Impact Assessment regarding the processing of personal data of employees through the video surveillance system, which we attach (Annex 14).
Regarding the access to video images from the Decathlon warehouse in Ilfov County, Ştefăneștii de Jos Village, Ştefăneștii de Jos Commune, #### ###### ### ## on 27.04.2024, they were accessed by an authorized employee from the company’s headquarters, based on a power of attorney from the company’s Administrator.
The company’s Administrator was informed in the period preceding 27.04.2024 about the possible commission of disciplinary offenses by the Director of the Decathlon warehouse work point and by the employee responsible for personnel management in the Decathlon warehouse.
##### considering that these persons were the only persons authorized to access the video images for monitoring the behavior of the employees and that accessing the images by these persons could have led to the deletion/destruction of the images and affected the quality of any possible disciplinary investigations of these persons, the persons responsible for accessing the respective images were the Company Administrator or an authorized person.
We note that in accordance with the provisions of the Internal Order Regulation of the undersigned, the Company Administrator may issue mandatory provisions and instructions for each individual employee. In this regard, the Company Administrator authorized an authorized employee from the company’s headquarters, who is part of the Operations Department, to access the CCTV images from the Decathlon warehouse and extract these images to external devices, so that the images can be analyzed by the Administrator and the disciplinary investigation committee, if applicable.
We attach the email sent by the Administrator to this employee on 27.04.2024 at 11:33 (Annex 15). We note that the employee accessed the video surveillance system to extract images starting at 12:00. Therefore, this employee did not exceed his duties and did not access/use the images in an unauthorized manner, being empowered by the Administrator of the company in this regard.
Furthermore, the video images were used by the members of the disciplinary investigation committees to determine whether the 2 employees committed disciplinary offenses by violating the internal order regulations and internal procedures of Decathlon. The members of the disciplinary investigation committees were appointed by the Administrator based on the Administrator’s decisions to appoint the disciplinary investigation committees. If you deem it necessary, we can also make these documents available to you.
We note that following the access to the video images and the administration of this evidence, as well as other evidence administered within the disciplinary investigation, one of the 2 employees was summoned for the purpose of conducting the preliminary disciplinary investigation, and following the summons, his individual employment contract was terminated for disciplinary reasons. The second employee is to be summoned for the purpose of conducting the preliminary disciplinary investigation, the summons not taking place at the moment due to the fact that the employee is on sick leave from 23.04.2024, and the company cannot summon the employee in accordance with the legal provisions as long as he is on sick leave.
12.#### the security requirements provided for by the legal provisions in force are complied with, and you will send us a copy of the documents through which the measures were adopted to ensure data security;
Regarding the technical and organizational security measures adopted by the undersigned in order to ensure the security of personal data processed through the video surveillance system, we note that the undersigned has adopted the following measures:
###### technical security measures:
•The images are saved on a local server at the work point. Being behind a Firewall, the server can be accessed from the Internet only through a special VPN together with a set of credentials (user, password, IP address);
•The Hik ###### application used to capture / play / store personal data collected through the video surveillance system is not connected to other systems and does not interact with other applications, the server on which it is installed being one dedicated to the Hik ###### application. There is no data synchronization or back-up;
•The Hik ###### application is updated directly by the supplier, if applicable. For the update, the supplier inserts a stick into the central unit of the video surveillance system and performs the offline, local system update. It does not connect to the Internet to perform the update;
•In the room where the company’s IT equipment is located, including the monitor on which the video images are displayed and the server on which the images are stored, there is a surveillance camera that records images of people entering the room;
•The Hik ###### application stores the date and time at which the CCTV system was accessed, and for Internet access, the user;
•The images are stored for a maximum period of 30 days if no incidents occur, upon expiration of the term the images are automatically deleted by overwriting;
•Access passwords on devices used in the performance of work tasks that can be used to process personal data (e.g. viewing images);
•Rules for setting different passwords depending on the employee’s job description and the risk in terms of the information processed by him (e.g. minimum length, minimum number of special characters, minimum number of digits, unsupported words, prohibition of using previous passwords, number of attempts before blocking the account, password expiration date);
•Access to IT resources and internal applications of ########## SRL that can be used to process personal data only through an IT account accessible only based on the ID and password, both personal and non-transferable. Each newly created IT account is implicitly assigned only the rights necessary to carry out the activities specific to the selected position;
•The devices used by employees have an antivirus running one of the last 2 versions made available by the manufacturer; the antivirus database is up to date;
•Important data stored on the employee’s work device is replicated in an external location (cloud);
•The device allows a verification procedure to establish compliance;
•Authentication is performed locally, on the device or under the management of ########## SRL (FED ID, Active Directory) + 2FA;
•To verify the compliance of the devices provided by ########## SRL, an IT audit is performed twice a year;
•Data transmission within ########## SRL is done via a private VPN (virtual private network);
•In the event of the loss of a work electronic device (laptop, tablet, phone), the data on the device is deleted remotely by the IT Security Department, according to the IT Security Policy;
•Documents on the laptop cannot be accessed from other devices if they are extracted because they are encrypted. In case of theft, the storage media cannot be connected to other devices because they are encrypted (bitlocker);
•In the event of loss of access to the laptop / phone through which an employee accesses the data, they can be accessed again by the employee by accessing his Google account from another device provided by Decathlon;
•Encrypted data transmissions on the internet (e.g. HTTPS, SFTP, etc.);
•Removable storage units, such as flash drives, external HDDs, must never be left in plain sight (office, car, plane, public place, etc.).
###### organizational security:
-Access to the room where the company’s IT equipment is located within the Decathlon warehouse work point, including the monitor on which the video images are displayed and the server on which the images are stored, is done with a key, available only to authorized persons;
-Access to the room where the company’s IT equipment is located within the Decathlon warehouse workplace and to the images recorded by the video surveillance system is limited only to the Workplace Director, the Deputy Director, the Day Director (the employee responsible for workplace security) and the employee responsible for personnel management at the workplace, according to the internal procedure that establishes the duties of the Workplace Director, the Deputy Director, the Day Director and the employee responsible for personnel management (Annex 13);
-Access to images for the purpose of monitoring employee behavior is limited only to the Workplace Director and the employee responsible for personnel management, according to Annex 13;
-Employees are trained at least annually on the rules that must be followed for the processing of personal data, and their knowledge in the field of data protection is tested through a mandatory test that is part of the training;
-#### an annual audit in the field of data protection is carried out in all ####-thlon workplaces. During the audit, aspects such as: compliance with the storage period of CCTV images, aspects related to compliance with the principle of data minimization, aspects related to compliance with the obligation of transparency towards data subjects, aspects related to limiting access to data strictly to employees necessary according to the activity they carry out;
-Staff with access to the CCTV system are trained on the fact that disclosure of data to third parties is not allowed and that CCTV images can only be disclosed to authorities, according to the company’s internal procedures;
-#### The IT Security Policy prohibits downloading and storing professional documents on personal devices or in personal clouds;
-The day’s manager (the employee responsible for workplace security) is obliged to accompany the maintenance service provider throughout the intervention period at the workplace;
-Employees must lock their laptop every time they leave it.
We attach the Decathlon IT Security Policy (Annex 16) and the Authentication and Password Security Policy (Annex 17).
13.#### you have had requests addressed to date regarding the exercise of the rights of the data subjects, as well as their resolution;
Until the date of this response, we have had 2 requests addressed by the data subjects regarding the processing of personal data through the video surveillance system. These requests were addressed by Decathlon customers.
##### request was a request to delete video images, and the undersigned ordered the deletion of the video images within the one-month period provided for by the GDPR. The second request consisted of requesting details regarding the location of the video cameras, and the undersigned also responded within the one-month period provided for by the GDPR.
We note that all the video cameras mentioned in chapter I point 2 of this response address were included by the designer within the Technical Security System Project code SS024 – 24/15.03.2024. We attach an extract from the Technical Security System Project that refers to the video surveillance system (Annex 18). If you deem it necessary, we can make the entire Technical Security System Project available to you.
In this regard, by virtue of art. 6 of the GDPR, the basis for processing personal data collected through the installed surveillance cameras is represented by the legal obligation and legitimate interest. Please also see our response in chapter I point 16 of this response address for details regarding the legitimate interest pursued by Decathlon.
14.#### is the manner in which the prior consultation of employees was carried out, before the installation and commissioning of the video surveillance system; please attach supporting documents;
We note that at the level of ########## SRL there is no trade union or employee representatives according to the Social Dialogue Law or the Labor Code. Therefore, there was no prior consultation of employees before the installation and commissioning of the video surveillance system, given that there is no employee representative body at the company level to be consulted.
However, the undersigned has prepared a Data Protection Impact Assessment in accordance with the legal provisions, regarding the processing of employees’ personal data through the video surveillance system, in order to ensure that personal data is processed in accordance with the provisions of the GDPR and that the rights and freedoms of employees are respected. As part of this assessment, we have introduced appropriate safeguards and measures to protect the rights and freedoms of employees that could be affected by such data processing (Annex 14).
15. The circumstances/circumstances in which the video surveillance system was accessed and the subsequent use of the video recordings for the purpose of sanctioning the employee/employees of your company, the purpose and legal basis;
As mentioned in Chapter I, point 11 of this response, the Company Administrator was informed in the period preceding 27.04.2024 of the possible commission of disciplinary offenses by the Director of the Decathlon warehouse work point and by the employee responsible for personnel management in the Decathlon warehouse. The 2 persons were the only persons in the Decathlon warehouse work point who could have accessed the video recordings for the purpose of monitoring the behavior of the employees.
##### in view of the conflict of interest between the duties of the 2 employees and their alleged acts, the fact that the collection of evidence by the members of the disciplinary investigation committees is confidential, as well as the fact that accessing the video images by the 2 employees could have led to the deletion of the images and affecting the quality of the disciplinary investigation, the Company Administrator authorized an employee from the company’s headquarters, within the Operations Department, to access the respective images and extract them on external devices for the purpose of securing the images, so that the images can be analyzed by the Administrator and the disciplinary investigation committee, if applicable.
In order to analyze the alleged acts of the 2 employees, the Company Administrator designated 2 disciplinary investigation committees. Within the 2 reports reporting potential disciplinary violations, the Company Administrator requested, among other things, verification of the 2 employees’ compliance with the work schedule. The disciplinary investigation committees analyzed the video images to determine whether the 2 employees committed disciplinary offenses related to non-compliance with the work schedule. If you deem it necessary, we can provide you with the reports of potential disciplinary offenses.
16.Legal basis for installing surveillance cameras at the workplace;
The video surveillance cameras were installed based on the provisions of art. 27 of Law ######## on the security of objectives, goods, values and the protection of persons, in conjunction with art. 68 paragraph 1 letter j), art. 69 and the provisions of Annex no. 1 of Decision no. 301/2012 for the approval of the Methodological Norms for the application of Law no. 333/2003 on the security of objectives, goods, values and the protection of persons.
Following the analysis of the images and the administration of these evidence, as well as other evidence administered within the disciplinary investigation, one of the 2 employees was dismissed for disciplinary reasons, and the second is to be summoned for the purpose of conducting the preliminary disciplinary investigation, the summons not taking place at the moment due to the fact that the employee is on sick leave since 23.04.2024, and the company cannot summon the employee in accordance with the legal provisions as long as he is on sick leave.
Therefore, the purpose of accessing the video surveillance system and using the images refers to conducting disciplinary investigations and proving certain disciplinary offenses.
Regarding the legal basis for data processing, the undersigned processed ###### personal data collected through the video surveillance system based on the legal obligation (as indicated above in our response to Chapter I, point 14 of this response address) and the legitimate interest of the company to make correct decisions in disciplinary investigations, to protect employees against abuses or illegal disciplinary sanctions and to avoid possible appeals regarding sanctioning decisions as a result of incomplete or incorrect disciplinary investigations.
Any other information that you consider relevant to clarify the case presented.
The relevant answers and information have been introduced in the previous points.
II. Transmission of information regarding the sick leave to a company lawyer (…)”
The minutes were drawn up based on all the information and documents mentioned in the findings section, in particular: petitions no. 8467/01.05.2024, no. 8468/01.05.2024 and no. 8470/02.05.2024, ANSPDCP request for information no. 9471/20.05.2024 and the responses of ########## SRL and the documents attached thereto no. 10686/06.06.2024 and no. 11394/14.06.2024.
The following acts were found to have been committed: the acts were found at the ANSPDCP headquarters in Bd. ####### ######## ####### no. 28-30, sector 1, Bucharest
On of this report, 02.04.2025, SC ########## SRL, with the registered office mentioned on the first page of this report, processed ###### personal data (image) of its employees, through the video surveillance means existing at the workplace/warehouse in ####### #####, village Ștefăneștii de Jos, ###### ########### ## ###, #### ###### ### ##, starting with 2017, including for the purpose of their disciplinary investigation, in violation of the processing principles regulated by art. 5 para. (1) let. a) and b), para. (2) of Regulation (EU) 2016/679 and the conditions of legality provided for in art. 6 para. (1) of Regulation (EU) 2016/679, in conjunction with art. 5 of Law no. 190/2018, as follows from the findings of this report.
This act constitutes the contravention provided for in art. 12 of Law no. 190/2018 in relation to the provisions listed in art. 83 par. (5) letter a) of the GDPR.
For the facts found, the following sanctions/corrective measures are applied:
Fine, in the amount of RON 24,887, the equivalent of 5,000 #### according to the NBR exchange rate on 02.04.2025, 13:30, for the violation of art. 5 par. (1) letters a) and b), par. (2) of the GDPR in relation to art. 6 par. (1) of the GDPR and art. 5 of Law no. 190/2018, pursuant to art. 58 par. (2) letter i) and 83 par. (5) letter a) of the GDPR, in relation to art. 14 par. (11) and art. 15 par. (1) and par. (6) of Law no. 102/2005, republished, to art. 12 of Law no. 190/2018, as well as to art. 8 of OG no. 2/2001;
Pursuant to art. 58 para. (2) letter d) of the GDPR, in relation to art. 14 para. (11) and art. 16 para. (5) of Law no. 102/2005, republished, the following corrective measures are ordered against the company ########## SRL:
Corrective measure to ensure the compliance of personal data processing operations in the video monitoring activity, in particular in the case of conducting disciplinary investigations of employees, with compliance with the principles and processing conditions provided for in art. 5 and art. 6 of the GDPR, respectively by art. 5 of Law no. 190/2018.”
As a preliminary matter, the court notes that, although the minutes also analyzed a potential act of disclosing an employee’s medical information, the defendant did not consider this to constitute a contravention, the plaintiff being fined only for the alleged illegal processing of the employees’ video image, which is also the reason why the court did not include in the minutes the aspects regarding this act.
In law, according to Law no. no. 102/2005 on the establishment, organization and operation of the National Supervisory Authority for Data Processing with ######## Staff:
“Article 14. (1) The national supervisory authority carries out investigations, in the cases and under the conditions provided for in its competence, through the staff empowered for this purpose, according to the law, by the president of the national supervisory authority, hereinafter referred to as control staff.
Article 15. (1) The main contravention sanctions applied by the national supervisory authority, according to art. 58 para. (2) let. b) and i) of the General Data Protection Regulation, are the warning and the fine. The application of the fine is made under the conditions of art. 83 of the General Data Protection Regulation.
Article 17. (1) Against the report of finding/sanctioning and/or the decision to apply corrective measures, as the case may be, the controller or the person empowered by the controller may file an appeal with the section administrative dispute of the competent court, within 15 days from the delivery, respectively from the communication. The decision by which the complaint was resolved may only be challenged by appeal. The appeal shall be heard by the competent court of appeal. In all cases, the competent courts are those of #######.”
According to the Code of Civil Procedure:
”Article 468. Appeal deadline. (1) The appeal deadline is 30 days from the communication of the decision, unless the law provides otherwise.”
In this case, with regard to the insufficient description of the fact, the court considers the plaintiff’s criticisms to be well-founded.
Contrary to the defendant’s claims in the response, the “We have found the following” section of the minutes does not describe the contravention and presents the course of the so-called investigations: the petitions claiming unauthorized access, the request for clarifications from the plaintiff, the plaintiff’s extremely detailed and punctual response to each request (which represents over half of the pages of this judgment, reproduced in full precisely to easily observe how meticulously each aspect requested by the defendant institution was responded to) and then the description of the contravention in the penultimate paragraph on tab 19.
#### the description (motivation) of an act does not represent a quantitative aspect, but a qualitative one, since complex aspects can be expressed succinctly in just a few sentences, it is worth noting that the plaintiff’s response to the defendant’s request regarding the processing of video images is reproduced on approximately 10 pages out of the 20 pages of the minutes (another 6 pages being dedicated to the plaintiff’s response regarding the disclosure of an employee’s medical information, not relevant in the present dispute), and the contravention for which the sanction was applied is described in a paragraph of 1/4 of a page:
“On the date of these minutes, 02.04.2025, SC ########## SRL, with the headquarters mentioned on the first page of these minutes, processed ###### personal data (image) of its employees, through the video surveillance means existing at the workplace/warehouse in ####### #####, village Ștefăneștii de Jos, ###### ########### ## ###, #### ###### ### ##, starting with 2017, including for the purpose of their disciplinary investigation, in violation of the processing principles regulated by art. 5 par. (1) let. a) and b), par. (2) of Regulation (EU) 2016/679 and of the conditions of legality provided for in art. 6 par. (1) of Regulation (EU) 2016/679, in conjunction with art. 5 of the Law no. 190/2018, as follows from the findings in this report.”
After the detailed response of the plaintiff in which it explains in detail how the image processing was carried out and that it meets the legal conditions, both of the GDPR and of Law no. 102/2005, the defendant limited itself to indicating the legal texts violated by the plaintiff, without in any way contesting the plaintiff’s claims and without even describing in detail what the illegal processing consisted of, so that the plaintiff could contest the defendant’s claims in court and so that the court could compare the situation resulting from the evidence with the situation described in the report.
The court emphasizes that the textual presentation of the course of the investigations without specifically describing at the end of the presentation the concrete fact found by the ascertaining agent as a contravention does not amount to a description of the fact within the meaning of art. 16 para. 1 of O.G. no. 2/2001: “The report of the contravention shall necessarily include: (…) a description of the contravention, indicating the date, time and place where it was committed, as well as the circumstances that may serve to assess the seriousness of the act and to evaluate the possible damages caused”.
In other words, while maintaining the inherent proportions and differences, it is as if the court, in drafting the decision, would only present the arguments of the parties and the course of the process, without specifically explaining what the court’s own reasons were that led to the solution in the operative part of the decision.
Furthermore, the court notes that not only was the act described generically as “illegal processing of personal data”, without mentioning the element that qualifies the processing as illegal (recording devices allegedly installed illegally, viewing of recordings by allegedly unauthorized persons, dissemination of recordings in an unauthorized manner, etc.), but the defendant did not even indicate the exact date or circumstances in which this alleged processing was carried out, limiting itself to stating that the act was carried out “starting with 2017”. This date was subsequently individualized in the response as being the date of 11.09.2017.
The fact that the act would represent a continuous contravention (as indicated in the response) does not remove the plaintiff’s obligation to provide a minimum description of the incidents found, especially since the sanctions were applied following specific notifications on 01.05.2024 and by no means 7 years ago.
Also, it is not individualized in any way which cameras the defendant institution refers to, where they were installed, etc. #### the plaintiff provides a detailed description of all the indicated aspects in response to the defendant’s request, the plaintiff does not even make a formal reference to the plaintiff’s response address. It cannot be considered that the defendant has appropriated the description of the situation from the petitions received, since these petitions are also summarized in the contravention report.
The court shows that the requirements of art. 16 para. 1 of O.G. no. 2/2001, partially cited above, are provided for by law under the sanction of relative nullity, requiring the annulment of the minutes only to the extent that the violation of the normative text caused harm to the sanctioned person and only to the extent that this harm cannot be removed in any other way than by annulling the contested act.
In the case, the court considers that both conditions are met, since the plaintiff suffered the harm of not being able to mount an effective defense before the court, and the court cannot assess with precision which legal conditions must be met (or have not been met), given that the illegal manner of processing the data represented by the video images is not specified in any way. Therefore, the only remedy for the plaintiff is the annulment of the minutes, which cannot be subsequently motivated before the court.
The Tribunal emphasizes that the lack of motivation/description in the minutes (which represents an administrative act) cannot be compensated for before the court by submitting objections/clarifications. In this regard, through its consistent case law (of which Decision no. ####/11.04.2008, published online, is worth mentioning), the High ##### of Cassation and Justice – Administrative and Fiscal Litigation Section has established that the concrete motivation formulated by the authority later, before the courts, is not likely to compensate for the lack of motivation at the time of issuing the administrative act. #### It is known that the discretionary power conferred on an authority cannot be regarded, in a state governed by law, as an absolute and unlimited power, since the exercise of the right of appreciation by violating the rights provided for by the Constitution or by law constitutes excess of power according to the provisions of art. 2 letter m) of Law no. 554/2004.
Therefore, the High Court ##### has also ruled in its case law that any administrative decision must be motivated not only from the perspective of the competence to issue that administrative act, but also from the perspective of the possibility of the person and society to assess the legality and soundness of the measure, respectively on the respect of the boundaries between discretionary power and arbitrariness. Moreover, in the Community case law it is also noted that the motivation must be appropriate to the issued act and must present in a clear and unambiguous manner the algorithm followed by the institution that adopted the contested measure, so as to allow the persons concerned to establish the motivation of the measures and also to allow the Community courts the competence to review the act. As the European Court of Justice, mentioned by the High Court #####, has decided, the extent and detail of the motivation depend on the nature of the adopted act, and the requirements that the motivation must meet depend on the circumstances of each case, an insufficient or incorrect motivation is considered to be equivalent to a lack of motivation of the acts. Furthermore, insufficient or no reasoning entails the nullity or invalidity of Community acts.
A detailed statement of reasons is also necessary when the issuing institution has a wide discretion, since the reasoning gives the act transparency, allowing individuals to verify whether the act is correctly substantiated and, at the same time, allows the courts to exercise judicial control. The participatory stance of the citizen is thus necessarily linked to the general Community principles, including that of transparency, and the most important way to give viability to these principles, including that of justice, is precisely the establishment of the obligation to state reasons for acts of public authorities.
#### of the above, establishing that the act was insufficiently described, since an adequate judicial review could not be carried out, the court will admit the contravention complaint and will annul the contested report, no longer being necessary to analyze the other arguments invoked by the action, regarding the groundlessness of the report.
Regarding the legal costs, considering art. 453 paragraph 1 C.p.c., according to which the party that loses the case will be obliged, at the request of the party that won, to pay the latter legal costs, as well as the fact that the court will admit the main claim, implicitly establishing the procedural fault of the defendant, the court will oblige the latter to pay the plaintiff the amount of 19,743.10 lei as legal costs, representing the lawyer’s fee, according to invoice ##### ### ### ######/22.05.2025 and the related bank statement, submitted at the trial date.
The Court points out that, although the documents submitted in electronic format on CD were useful for the drafting of the judgment, all the documents referred to in this judgment were physically submitted to the file before the applicant filed its response to the statement of defence, the latter having knowledge of those documents. This clarification is made in the light of the fact that the case was not adjourned at the applicant’s request in order to study the latest clarifications.
FOR THESE REASONS,
IN THE NAME OF THE LAW
RULES:

Admits the request for summons filed by the plaintiff ########## S.R.L., with its registered office in Bucharest, #### ##### ####### ### ###, Globalworth Tower Building, ### ##, Sector 2, in contradiction with the defendant National Data Processing Supervisory Authority with ######## Personnel, with its registered office in Bucharest, ### ####### ### ##-30, Sector 1.
Cancels the report of contravention no. 6802/02.04.2025.
Orders the defendant to pay the plaintiff the amount of 19,743.10 lei as legal expenses, representing the lawyer’s fee.
With the right to appeal within 30 days from the communication of the decision, the appeal request is submitted to the Bucharest Court, Section II – Administrative and Fiscal Litigation.
Solution made available by the court registry, today, December 10, 2025.

President Registrar

Red. ######### 10.12.2025/V.S./4 Ex./2 Ex. Com.
</pre>

VfGH – E2189/2025

ICO (UK) – ZMLUK Limited