Last updated: 19 November 2015
In order to ensure an additional protection of personal data and the right to private life of phone and Internet service subscribers and users, President Klaus Iohannis has promulgated Law no. 235/2015, amending and supplementing Law no. 506/2004 regarding personal data processing and the protection of private life in the electronic communications sector, also known by the public as the “Big Brother” Law.
Thus, in accordance with the “Big Brother” Law, access to personal data of phone and Internet service subscribers and users can only be achieved within a precisely established framework, by the courts, or only with the prior approval of a judge.
TRAFFIC DATA CAN BE STORED FOR 3 YEARS
The “Big Brother” Law provides a maximum period for the storage of traffic data of phone and Internet service subscribers and users.
More precisely, the new law provides that subscribers’ and users’ traffic data, which is currently being processed and stored by phone and Internet service providers in order to issue invoices and supply such services, will be deleted or anonymized when they will no longer be necessary for communication, but no later than three years from such communication.
Furthermore, the maximum period of three years from the communication will also apply to traffic data processed in order to establish the contractual obligations of communication services subscribers, services which are paid for in advance.
ACCESS TO DATA, ONLY WITH THE PRIOR APPROVAL OF A JUDGE
As regards to the access of the authorities to data stored by phone and Internet operators, “Big Brother” Law expressly provides that such access will only be allowed at the courts’, prosecutors’ and national and security authorities’ request, with the prior approval of a judge.
At their turn, providers of publicly available electronic communication services and providers of public electronic communication networks are obliged to immediately make available to the authorities, no later than 48 hours, traffic data, device identity data and location data, in accordance with the provisions related to personal data protection.
Data requested by the authorities cannot be deleted or anonymized by phone and Internet service operators when such request is accompanied/followed by a notice stating the necessity to preserve such data. Nevertheless, the said data will not be kept longer than 5 years from the date of the request or after the Court renders a final ruling.