Venice Commission - Report on a rule of law and human rights compliant regulation of spyware

Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).

Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/

Romania

1. Does your legal framework allow for the use of spyware as a tool of targeted surveillance either in criminal or intelligence investigations or is there an explicit prohibition on the use of spyware? If so, how does your domestic legal framework define spyware?

No, there is no specific legislation concerning spyware.

2. Are there specific rules (covering notably the scope ratione materiae, temporis and personae) in place or do the general rules on targeted surveillance (interception of communications) apply (could you please provide us with such specific or general rules)?

Romanian legislation permits surveillance under certain conditions in the context of national security and criminal investigations. For instance, the Code of Criminal Procedure (Articles 138–142) outlines various surveillance methods, including wiretapping, accessing computer systems, and video/audio surveillance. Moreover, Law No. 51/1991 on National Security grants Romanian authorities the power to conduct surveillance when national security is at risk. Finally, Law No. 14/1992 and Law No. 1/1998 regulate the organization and operations of the Romanian Intelligence Service (SRI) and the Foreign Intelligence Service (SIE), giving them authority to use surveillance tools within legal boundaries.

3. What kind of data, if any, could be collected with spyware?

4. Has there been any official evaluation of the need for, or added value of, spyware?

5.Who authorises/approves measures of targeted surveillance in criminal and intelligence investigations (judiciary, executive, expert bodies, security services)?

Surveillance warrants are issued by a judge when evidence cannot be obtained through less intrusive means. In emergency situations, prosecutors can authorize surveillance for up to 48 hours, with subsequent judicial review (Article 141 § 1 of the Code of Criminal Procedure). If surveillance yields no useful information, it must be destroyed to protect individual privacy.
Surveillance activities by the SRI and SIE are authorized only when aligned with national security interests.

6. What are the national oversight mechanisms in place in your country for the activities of the security services (are they judicial, parliamentary, executive, or expert)? Do these bodies have (binding) remedial powers?

Romania employs parliamentary committees for intelligence oversight.

7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?

Under the Law on National Security (Law No. 51/1991), if data does not support further investigation, individuals must be informed of the surveillance unless this risks national security or the confidentiality of sources. Article 21 § 2 of Law no. 51/91 on the National Security of Romania prescribes that a notification is excluded if: (a) it could lead to jeopardising the performance of the official duties of State bodies responsible for national security by disclosing their sources, including those of the security and intelligence services of other States; (b) could affect the defence of national security; (c) could prejudice the rights and freedoms of third persons; (d) could lead to the disclosure of the methods and means, including specific investigative techniques, used in the case in question by State bodies responsible for national security.