EdLaw
Romania — Legea nr. 190/2018
Romania's GDPR implementing act (Monitorul Oficial nr. 651 of 26 July 2018), giving national effect in particular to Arts. 6(2), 9(4), 37–39, 42, 43, 83(7), 85 and 87–89 GDPR. The supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).
The statute text is reproduced in Romanian, the authentic language — see LEGEA-190-2018.md.
Applicability to EdTech
Three parts of this act bite on a supplier to Romanian schools, and one of them changes who carries the risk.
Biometrics and profiling. Processing genetic, biometric or health data for automated decision-making or profiling is permitted only on the narrow grounds in art. 3 — a materially tighter rule than GDPR Art. 9 alone, and the provision to read before any headset or classroom analytics feature that identifies a pupil.
Workplace monitoring. Art. 5 sets five cumulative conditions for monitoring employees through electronic communications or video, including prior explicit information, consultation of the union or employee representatives, a less-intrusive-means test, and a hard 30-day storage cap on the resulting data (art. 5 lit. e). This reaches staff-facing device management, not pupils.
Who gets fined. Romanian state schools are "autorități și organisme publice" as defined in art. 2 lit. a. For them the act interposes a remediation plan before any fine: the authority is given a remediation term of at most 90 days (art. 2 lit. e), and only on failure does a sanction follow. A vendor has no such buffer — so the school's exposure and the supplier's are not symmetric, and a contractual indemnity written as if they were will misprice the risk.
Key obligations at a glance
- Definitions, including public authorities and the remediation regime's terms — art. 2.
- Genetic, biometric and health data in automated decision-making or profiling — art. 3.
- Processing a national identification number (CNP) — art. 4.
- Employee monitoring: five cumulative conditions, 30-day retention cap — art. 5.
- Processing for public-interest tasks — art. 6; journalism and academic expression — art. 7; scientific and historical research derogations — art. 8 (alineat (1) amended by Legea nr. 233/2019 with effect from 1 December 2019).
- Designation and tasks of the data protection officer — art. 9.
- Corrective measures and sanctions, with the public-authority remediation route — art. 11 onwards.
Contents
| Document | Covers |
|---|---|
| LEGEA-190-2018.md | the whole act in Romanian — Capitolele I–VI, art. 1–16 plus the annex |
Licence
The corpus reproduces Legea nr. 190/2018 from the Portal Legislativ of the Ministerul Justiției (base document, amendments integrated in place).
Romanian copyright law places official legislative texts outside copyright. Articolul 9 of Legea nr. 8/1996 privind dreptul de autor și drepturile conexe (Portal Legislativ — Legea nr. 8/1996, read 2026-10-01 in the Internet Archive's id_ capture of 2026-07-14, because the portal refuses this network) provides: "Nu pot beneficia de protecția legală a dreptului de autor următoarele: [...] b) textele oficiale de natură politică, legislativă, administrativă, judiciară și traducerile oficiale ale acestora;"
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each extracted provision carries a {.meta} provenance line, and Sources here links the official text (the Portal Legislativ). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.
Related
- EU GDPR — the directly applicable substance this act implements
- Legea nr. 506/2004 — the Romanian ePrivacy transposition
- Legea nr. 198/2023 — the pre-university education act (still a citation stub)
- UODO — the Polish sibling implementation
Sources
- Portal Legislativ — Legea nr. 190/2018
- ANSPDCP — the supervisory authority