XVII. Personal data processing in the field of…

Processed data categories and informing the data subjects about the rights they enjoy in the personal data processing flow in order to obtain Romanian entry visas and LBTPs

Among the principles underlying the processing of personal data are: good faith, authorization and accountability in the processing of personal data; collecting data solely for well-defined, explicit and legitimate purposes; the adequate and non-excessive collection of personal data in relation to the purpose for which it is collected and processed; confidentiality regarding the processing of personal data; complying with the rights of data subjects.

Any processing of personal data may be carried out by the MFA only if the data subject expressly and unequivocally consented to such processing in accordance with the provisions of art. 6 para. (1) of the GDPR. As a controller, the MFA processes only the data categories necessary for the examination of the visa applications made in accordance with the provisions of GEO n° 194 / 2002 republished, with the subsequent amendments and completions and LBTP requests in accordance with the provisions of the bilateral agreements in the field concluded by Romania. In this respect, the following categories of personal data are processed: alphanumeric and biometric data relating to the applicant; requested, previously requested, issued, refused, canceled, withdrawn or prolonged visa and LBTP related data, as appropriate; links with other requests of the same applicant.

The provision of certain categories of personal data is not mandatory for third-country nationals who are members of the family of citizens of the European Union, the European Economic Area and the Swiss Confederation. The data on the visa form (also valid after the date of accession to the Schengen area), marked with an asterisk (*) - ex: the current occupation, the name of the employer or the name of the host are, inter alia, not compulsory for family members of citizens of the European Union, of the European Economic Area and of the Swiss Confederation, proving the family bond with documents in this respect.

By way of exception, in accordance with the provisions of art. 9 para. (2) (a) of the GDPR, MFA processes special categories of data when the data subject expressly consents to such processing. Special data may only be collected from the data subject when it serves the purpose of processing (visa / LBTP). Processing of special data is only made after obtaining the consent of the data subject (expressly, unequivocally, informed and given in writing by signing the visa/LBTP application form) and under a legal provision, in accordance with the principle that the data collected must be appropriate, relevant and non-excessive in relation to the purpose of the processing, examination and approval of an application (e.g. health data when the processing of such data is necessary to ensure risk prevention measures to public health). In this respect, the collected sensitive data shall not exceed the purpose established by the provisions of the GDPR and the special legislation in the field, for which is collected - the processing, examination of visa / LBTP applications, as well as their approval and issuance.