WHEREAS:
(i) The European Parliament and Council have adopted at April 27, 2016 the EU Regulation 2016/679 concerning the protection of natural persons regarding the personal character data processing and the free circulation of such data, as well as the abrogation of Directive 95/46/EC (The General Regulation on data protection - RGPD). The EU Regulation 2016/679 was published in the Official Journal of the Union, L119 of May 4, 2016 and its provisions will be directly applicable in all member states of the European Union, starting with the date of May 25, 2018. The EU Regulation 2016/679 imposes a unique set of rules in the matter of personal character data protection, superseding Directive 95/46/EC and, implicitly, the provisions of Law no. 677 / 2001.
(ii) The EU Regulation 2016/679 places accent on transparency as to the person in question and holding responsible the data operator for the way they process the personal character data. The EU Regulation 2016/679 establishes a set of specific guarantees to protect as efficiently as possible the private life of the under aged, especially in the on-line media. The EU Regulation 2016/679 consolidates the granted rights of the persons in question and introduces new rights: the right to be forgotten about, the right to data portability and the right to restriction of processing. The EU Regulation 2016/679 presents severe sanctions, up to 10 – 20 million Euros or between 2% and 4% of the turnover at international level for the private sector operators.
THE FOREGOING INFORMATIVE NOTE WAS DRAWN UP CONCERNING THE PROCESSING OF PERSONAL CHARACTER DATA VIA VIDEO MEANS
1. The scope of video means aided processing
RIN Grand Hotel, RIN Central Hotel and RIN Airport Hotel process personal character data, respectively the image, through video systems in order to monitor the access of persons to the hotel units, to assure the security of spaces and goods as well as to assure the safety of the individuals from the hotel units.
The hotel units within RIN Hotels use the video surveillance subsystems to assure the safety and security of locations.
Considering that the processing of personal character data (image) through means of video surveillance is obligatory, the refusal of the person to present the respective data determines denying access of such person inside the hotel facilities.
2. Legitimacy conditions
Processing personal character data by using video surveillance means, installing and using from a technical point of view the equipment and components of the video surveillance system is realized in conformity with the legal provisions in the field:
- Regulation no. 679/2016 concerning the protection of persons regarding the personal character data processing and the free circulation of such data and of abrogation of Directive 95/46/EC (General Regulation concerning the protection of data - RGPD);
- Decision no. 52/2012 concerning the processing of personal character data by using means of video surveillance, issued by the president of the National Authority for the Surveillance of the Personal Character Data Processing (ANSPDCP);
- Law no. 333/2003 on guarding objectives, assets, valuables and the protection of persons, republished, with the subsequent additions and alterations,
- Methodological Norms for applying Law no. 333/2003, approved by GD no. 301/2012, with the subsequent alterations and supplementations;
- Order no. 52/2002 concerning the approval of the minimal security requirements of personal character data processing, issued by the People’s Advocate;
As per the provisions of art. 13 par. (2) from the Decision no. 52/2012 concerning processing of personal character data via video means of surveillance, the processing of personal character data via video means of surveillance is to be performed only by operator authorized personnel (employees of the operator).
3. Monitored areas
The placement of the surveillance cameras was done according to the legislation in force and based on the security plan approved by the competent Authorities. There are not monitored the areas with a high level of expectations concerning private life (offices restricted to the public access, rest rooms and other similar locations). In exceptional cases, due to duly justified security necessities, there will be installed surveillance cameras in the offices where the employees carry out their work but only pursuant to an impact assessment and to the notification of the person in charge with the data protection. In such cases, the dispositions of art. 8 par. (2) and par. (3) from the Decision no. 52/2012 will be observed.
There will be monitored by video means:
- access areas and facilities for the public;
- restricted areas;
- access areas to the hotels
4. Transparency and information
RIN Hospitality Company SRL furnishes to persons entering the video surveilled area the information provisioned by the General regulation concerning data protection and by art. 11 from Decision no. 52/2012, issued by the ANSPDCP president.
In this sense, the information from the Regulation wording are brought to the attention of the envisaged persons, clearly and permanently, by using a “Briefing note” displayed in the monitored locations, at a reasonable distance from the location of the surveillance gears, to be visible by anybody.
5. Protection of private life and security of information
In order to protect the security of the video system and to increase life protection level, the following technical and organizational measures have been introduced:
- limitation of footage storing time, conformant with the security requirements;
- storage media (digital video recorders) are in secured spaced, protected by physical security measures;
- all users with access clearance have executed a job description undertaking to observe the legal provisions in the field of personal character data processing;
- access right is granted to users only for such resources that are strictly necessary to fulfil the work tasks;
- the person with the right to grant, modify or annul users’ access right, according to the procedure of accessing data bases, is the system administrator, assigned by the operator;
- the administrator / the person in charge with the physical security system assigned, will keep on permanent basis an updated list of all persons with access right to the video surveillance system, stating access type;
- the person in charge with the personal data protection will be briefed prior to the installation of any new video system.
Nevertheless, it was taken into consideration the prevention of illegal processing of personal character data or unauthorized access to such data.
6. Access to the personal character data collected via the video surveillance system
The access to the video footages recorded and aired is limited to a reduced number of persons (company employees) who can be clearly identified and determined by the attributions specified in the job description (the scope and type of access).
Access to filmed material and/or to the technical architecture of the video system is limited to a reduced number of persons (company employees) who can be clearly identified and determined by the attributions specified in the job description (the scope and type of access).
RIN Hospitality Company SRL sets limits as to the persons with the right to copy, download, delete or edit any filmed material.
All personnel members with right to access video footages will be instructed in the field of data protection. Every new addition to the personnel will undergo initial training, following that periodic workshops on themes concerning data protection to be held at least biannually for all personnel members with right to access data.
Any security breach concerning the subsystem of video surveillance will be recorded in the Investigations Register and the Responsible person with data protection will be informed about such breach, without any unjustified delay, in 12 hours tops.
The video surveillance system will not be used to check the work attendance or evaluate the performance on the job.
In exceptional cases, provided the above detailed guarantees are observed, access may be granted to the Disciplinary research commission to investigate a case of discipline breach, with the condition that the information help clear the investigation of an offence or misconduct that could bring prejudice to the rights and liberties of a person.
7. Disclosure of personal character data obtained through the video surveillance system
The information recorded by the video surveillance system are designed for use by RIN Hospitality Company SRL for the monitoring of persons entering the company, for assuring the security of facilities and assets of the company, as well as for the safety of the persons from the company’s headquarters and are being put at the disposal of the judicial organs and of the lawfully habilitated institutions requesting such information, upon express demand.
Any activity of transfer and disclosure of personal data to third parties will be documented and rigorously evaluated concerning the necessity of communication and compatibility between the scope of communication and the scope for which such data have been initially collected for processing (for security and access control). In these cases will be consulted the person in charge with the data protection assigned at the level of the data operator.
Any disclosure situation will be registered by the system administrator in the disclosure cases evidence register.
The images recorded via the video surveillance system placed inside the hotel units may be presented to the judicial organs, upon express request.
8. Storage duration
The duration for storing the data obtained by the video surveillance system is proportional with the scope for which such data are processed, so that the images are stored for a period not exceeding 30 days, less the situations expressly regulated by law or the strongly justified cases.
Upon expiry of the storage period, the data are erased automatically in the order of recording.
In case of a security incident as in cases strongly justified, the duration of storage of relevant footages may supersede normal limits depending on the time necessary for the additional investigation of the security incident.
The storage is rigorously documented and the necessity of storage is periodically reviewed (every two months).
In case the storage duration exceeds the 30 days term, this will be entered into the register of footages exceeding storage duration, managed by the system administrator.
9. Rights of the data subject
RIN Hospitality Company SRL guarantees to assure the observance of rights belonging to data subjects, as per the Regulation no. 679/2016 concerning protection of natural persons regarding processing of personal character data and the free circulation of such data and the abrogation of Directive 95/46/EC.
All persons involved in the video surveillance activity and those liable for the administration of footages will abide by the procedure of accessing personal character data.
Information of data subjects will be performed in a clear manner and on a permanent basis through an appropriate sign, with sufficient visibility and placed in the surveilled area such as to signal the existence of surveillance cameras and to communicate the essential information about processing personal character data.
The person in charge with the data protection will assure the update of briefing according to realities existent within the developed activities.
In conformity with the dispositions of Regulation no. 679/2016, the data subject has the following rights:
- right to access
- right to rectification
- right to erase data (″the right to be forgotten about″),
- right to restriction of processing
- right to data portability
- right to opposition
- right not to be the object of a decision based exclusively on automatic processing, including profiles creation.
In order to exercise the above mentioned rights, the data subject must submit an application in written form, dated and executed (as the model presented under the section Requests concerning exercising of rights) to the address:
RIN HOSPITALITY COMPANY SRL
Sos. Vitan Bârzeşti no. 7D-7E, district 4, Bucharest
e-mail: dpo@rinhotels.ro
For additional information, you may contact the person in charge with data protection at the phone number +40 372 100 000 or at the e-mail address: dpo@rinhotels.ro
We specify the fact that rights’ exercising is free for a single application during a calendar year. Nevertheless, as per the General Regulation on data protection, the data subject is entitled to press charges (art. 77) with the National Authority for the Surveillance of Personal Character Data Processing, at its headquarters from Bld. G-ral Gheorghe Magheru no. 28-30, District 1, Bucharest, zip code 0103336, e-mail: anspdcp@dataprotection.ro or turn to justice (art. 79).
RIN HOSPITALITY COMPANY SRL processes your personal character data (video images obtained through automatic means) in order to: prevent and control offences, monitor access of persons, assure security of spaces and assets, as well as safety of persons inside the hotel. The placement of the video cameras was decided according to the security plan approved by the competent authorities. The storage time for the video footages is of 30 days, access to such footages being restricted only to persons with attributions in the field of Management, IT and Security. Following this period, the personal character data in the form of video recordings are automatically erased. These data may be conveyed also to the competent authorities in the field of: prevention and control of infractions/contraventions.