The protection of personal data is one of the fundamental rights, freedoms and principles recognised in the Charter of Fundamental Rights of the European Union and in the Treaty on the Functioning of the European Union, in particular the processing of personal data and the free flow of such data within the European Union, which cannot be restricted or prohibited.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC was drafted in order to ensure a consistent and high level of protection for individuals and to remove obstacles to flows of personal data within the EU, under the aegis of the European Commission.

In order to observe these rights, European legislation has been supplemented by national legislation, thus giving rise to a legislative package including rules that include:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
• Law No 102 of 3 May 2005 concerning the establishment, organisation and functioning of the National Supervisory Authority For Personal Data Processing, as subsequently amended and supplemented – republished
• Law No 190 of 18 July 2018 regarding certain measures implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
• Law No 363 of 28 December 2018 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, detection, investigation, prosecution and combating of criminal offences or the execution of criminal penalties and educational and safety measures, and the free movement of such data
• Documents of the European Data Protection Board
• Guidelines issued by the National Supervisory Authority For Personal Data Processing

In Romania, the National Supervisory Authority For Personal Data Processing (ANSPDCP) is the institution responsible for monitoring the application of Regulation (EU) 2016/679.

In this capacity, the ANSPDCP plays an important role in protecting the fundamental rights and freedoms of natural persons in relation to processing and in facilitating the free flow of personal data within the European Union.

National legislation was amended in order to allow the ANSPDCP to provide an adequate legal framework for the observance of individuals’ specific rights in the area of personal data processing, including:

• the right to information;
• the right of access;
• the right to rectification;
• the right to restriction of processing;
• the right to erasure of data;
• the right to object;
• the right to data portability;
• the right to be forgotten.