Romania - Personal data aquires protection under New Criminal Code

The exceptions

Paragraph 4 of Art. 226 of the Code provides for four cases where the above offences would be deemed as unpunishable:

a) if the author of the alleged offence claims a legitimate interest;

b) if the individual whose image or voice was misused or disclosed acted explicitly with the intention to be seen or heard by the author of the alleged offence;

c) if the author, by committing the alleged offence, contributed to the evidencing of another criminal offence; or

d) if facts of public interest, important for a community, are uncovered as a result of committing the offence, and its disclosure provides for a public advantage greater than the prejudice incurred by the individual whose image or voice was disclosed.

Limitations of the offence

There are two points to be made in relation to these new offences. Firstly, such legislation only incriminates unauthorized acts relating to a very limited range of personal data, i.e. the image or voice of a person. As a result, the protection offered by the Code does not extend to other personal data of an individual, such as his/her name, address, identity card or passport number, personal numeric code, biometric data, email or phone number.

Secondly, no definitions are provided for the terms mentioned in paragraph 4 of Art. 226 of the Code, which concerns cases that preclude criminal punishment for use or disclosure of the voice or image of an individual. As a consequence, the prosecutor handling a case, and subsequently the court overseeing the prosecution indictment relating to such case, will have to apply discretion when assessing whether an image or the voice of an individual was properly used, as per one of the four exceptions provided by paragraph 4 of Art. 226 of the Code.

Recommendations

While we view the fact that any un-authorized use of an image or the voice of an individual is punishable as a criminal offence as a positive development, we recommend that legislators extend the scope of criminal protection provided under the Code to cover a greater range of personal data and include the name, address, identity card or passport number, personal numeric code, biometric data, email or phone number of an individual as well.