Law note · Romania
GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP Rules
General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Commentary describes a genuine Romanian addition tied to automated decision-making rather than employment: processing genetic, biometric, or health data for automated decision-making or profiling requires explicit consent or express legal authorization, with adequate protective measures.
A second commentary-described addition covers the national identification number: where a controller relies on legitimate interests to process it, the Act reportedly requires a Data Protection Officer, adequate technical and organizational measures, specific retention terms with deletion deadlines, and regular staff training. Neither was independently verified against the Act's own text this session, and no employment-specific biometric provision was found in either commentary source.
No commencement date is recorded for this instrument: this document rests entirely on commentary with no primary-source text read, and status is downgraded from in_effect to enacted rather than asserting an unconfirmed effective date.
What it asks of an app
- Obtain explicit consent or express legal authorization, with adequate protective measures, before using genetic, biometric, or health data of a person in Romania to drive an automated decision or profile, per commentary describing Law 190/2018.
- Appoint a Data Protection Officer and set specific retention and deletion deadlines if relying on legitimate interests to process a Romanian national identification number, per commentary describing the Act; verify against the Act's own text before relying on it.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: CMS and DLA Piper commentary only
Act's own text not read this session