The purpose of the Law no 677/2001 is to guarantee and protect the individual's fundamental rights and freedoms, especially the right to personal, family and private life, with regard to the processing of personal data. The law applies to personal data processing, performed, totally or partially, through automatic means, as well as to the processing through means other than automatic ones, which are part of, or destined to, a personal data filing system.
The National Authority for the Supervision of Personal Data Processing was set up through the Law no. 102/2005 and it has the goal of protecting the fundamental rights and freedoms of the natural persons, especially the right of intimate, family and private life, in connection with the processing of personal data and the free circulation of these data. The authority supervises and controls the legality of the personal data processing which falls under the Law no. 677/2001.
The condition of legitimacy regarding the data processing refers to the fact that any personal data processing may be carried out only if the data subject has given his/her express and unequivocal consent for that processing, excepting the specific cases mentioned by the law.
The rights of the data subject in the context of personal data processing are expressly mentioned by the legislator:
- The right to be informed
- The right of access to data
- The right of intervention upon the data
- The right to object
- The right not to be subject to an individual decision
- The right to refer to a Court of Law