The processing of personal data gives rise to disputes between companies and individuals, between employers and employees, between controllers and their contractual partners and, not least, between organisations and the supervisory authority. In data protection matters, an apparently technical measure may have significant legal consequences: an investigation by the authority, a sanction, a claim for damages, a request for erasure or access to data, a challenge to a monitoring measure, or litigation concerning the disclosure or use of information. SĂVESCU & ASOCIAȚII is a firm of litigators. We approach data protection from this perspective: we identify the legal risk, build the evidential strategy and defend the client’s interests before authorities and courts.
Data protection litigation. We represent clients in disputes concerning the application of the General Data Protection Regulation (GDPR) and the relevant national legislation. Such disputes may concern, among other matters:
– challenges to sanctions and measures imposed by the supervisory authority
– the lawfulness of personal data processing
– the exercise of the rights of access, rectification, erasure, restriction or objection
– unauthorised disclosure or unlawful use of data
– security incidents and personal data breaches
– claims for damages allegedly arising from breaches of data protection rules
– processing of employee data and workplace monitoring
– use of images, audio-video recordings, electronic communications and location data
– automated decision-making, profiling and the use of information systems processing personal data
– disputes concerning the transfer of data to contractual partners, service providers or other entities
– liability of controllers and processors.
In many cases, data protection issues do not arise in isolation. They intersect with employment law, contract law, administrative litigation, intellectual property, competition law, civil liability or criminal law. We develop the litigation strategy with all these relationships in mind.
Investigations and sanctions. We assist organisations in their dealings with the National Supervisory Authority for Personal Data Processing (ANSPDCP), including where information and documents are requested, investigations are carried out or corrective measures and sanctions are imposed. The involvement of a lawyer from the investigation stage is important. The documents and explanations submitted to the authority may later become essential elements in litigation. We analyse the facts, the legal bases for the processing, the documents and systems involved, determine the response strategy and prepare the defence with the possibility of a subsequent court challenge also in mind.
Compensation for GDPR breaches. Breaches of data protection rules may give rise to claims for financial compensation. We assist both individuals and organisations against which claims for damages are brought, as well as in assessing and pursuing claims arising from the unlawful use of personal data. In such disputes, we examine separately the existence of the infringement, the alleged loss, the causal link and the evidence by which each of these elements may be established or challenged.
Personal data in employment relationships. Employment is one of the areas in which data protection frequently gives rise to disputes. Monitoring professional communications, use of email and company devices, video surveillance, access-control systems, location tracking, internal investigations and the use of employee data in disciplinary proceedings simultaneously raise issues of employment law, privacy and data protection. We assist and represent employers and individuals involved in such disputes, including where personal data is relied upon as evidence in judicial proceedings.
Security incidents and cyberlaw. A cyber incident can very quickly become a legal incident. Unauthorised access, loss or disclosure of data, compromised accounts, accidental transmission of information or cyberattacks may trigger notification obligations, investigations by the authority, claims by affected individuals and disputes between contractual partners. We provide legal assessment of the incident, preserve evidence, manage communications with authorities and the persons involved, and prepare the strategy for any resulting litigation.
Evidence in personal data litigation. In data protection litigation, evidence is often decisive. Logs, emails, databases, internal policies, records of processing activities, screenshots, recordings, application configurations, contracts and correspondence may establish what data was processed, by whom, for what purpose, at what time and under what conditions. From the outset, we analyse not only the legal argument, but also whether and how it can be proved. For us, GDPR compliance does not mean merely having documents in place. It also means the organisation being able to explain and prove, when a dispute arises, what it did, why it did it and on what legal basis.
Advice aimed at preventing disputes. We provide data protection advice particularly where it is necessary to assess a specific legal risk or prevent a dispute. We draft legal opinions, analyse processing activities, contracts, procedures and incidents, and assist management in making decisions that may have contentious consequences. Our litigation experience shapes the way we provide advice: we anticipate the questions the authority may ask, the arguments an opposing party may advance and the evidence that may need to be presented before a court.
In data protection, the best litigation strategy begins before the dispute arises.
Dr Andrei Săvescu, Lawyer
Alina Matei, Lawyer
Raluca Onufreiciuc, Lawyer