PRIVACY NOTICE
regarding the processing of personal data carried out by Romanian Railway Investigation Agency – AGIFER
The Romanian Railway Investigation Agency – AGIFER, headquartered at Calea Griviței no. 393, Sector 1, Bucharest, telephone +40 21 307 79 03, fax +40 21 307 68 05, website www.agifer.ro, acting as a personal data controller, hereby informs you about how it processes personal data in the course of its activities and about the rights to which you are entitled.
The processing of personal data is carried out in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), Law no. 190/2018 on measures for implementing Regulation (EU) 2016/679, as subsequently amended and supplemented, as well as with all other applicable national and European legal provisions relevant to the activities carried out by AGIFER.
The Data Protection Officer (DPO) within AGIFER may be contacted at: E-mail:
This Notice is general in nature and may, where appropriate, be supplemented by specific notices made available to data subjects for particular processing operations.
I. Principles of personal data processing
AGIFER processes personal data lawfully, fairly and transparently, for specified, explicit and legitimate purposes and only to the extent that the data are adequate, relevant and limited to what is necessary in relation to the purposes of the processing.
Data are kept accurate and, where necessary, up to date, retained only for as long as necessary to fulfil the purposes and legal obligations, and protected through appropriate technical and organisational measures.
II. Legal basis and purposes of processing
Depending on the activity carried out and the specific purpose pursued, the processing of personal data within AGIFER is primarily based on the following legal grounds:
- Article 6(1)(a) of the GDPR – only where the processing is validly based on the consent of the data subject;
- Article 6(1)(b) of the GDPR – where applicable, when the processing is necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract;
- Article 6(1)(c) of the GDPR – when the processing is necessary for compliance with a legal obligation to which AGIFER is subject;
- Article 6(1)(e) of the GDPR – when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in AGIFER.
With regard to the investigation of railway accidents and incidents, data are processed for the exercise of AGIFER's statutory duties, in particular pursuant to Government Emergency Ordinance no. 73/2019 on railway safety, as subsequently amended and supplemented, and Government Decision no. 716/2015 on the organisation and functioning of the Romanian Railway Investigation Agency – AGIFER. Where processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest assigned to AGIFER by law, the consent of the data subject does not constitute the legal basis for the processing.
Special categories of personal data
Where, in carrying out its duties, AGIFER processes special categories of personal data, including health data, such processing is carried out only where one of the exceptions provided for in Article 9(2) of the GDPR applies and the applicable legal requirements are fulfilled.
Depending on the specific activity, the following provisions may apply, where appropriate, in particular:
- Article 9(2)(b) of the GDPR – for processing necessary in the field of employment, social security and social protection, under the conditions laid down by Union or national law or by an applicable collective agreement;
- Article 9(2)(g) of the GDPR – where processing is necessary for reasons of substantial public interest, on the basis of Union or national law and subject to the safeguards provided by law;
- Article 9(2)(h) of the GDPR – for processing necessary for the purposes of occupational medicine or the assessment of the working capacity of the employee, in compliance with the conditions laid down in Article 9(3) of the GDPR.
The explicit consent referred to in Article 9(2)(a) of the GDPR is used only when it constitutes an appropriate legal basis, can be freely given, and all GDPR requirements are met. Consent is not requested as a substitute for an existing legal basis where processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest.
III. Categories of personal data processed and main activities
The categories of data processed vary depending on the activity carried out. AGIFER applies the principle of data minimisation. The Personal Numeric Code (CNP), identity document series and number, and other national identification numbers are processed only when necessary and where there is a legal basis for such processing, in compliance with the GDPR and Law no. 190/2018.
1. Accident and incident investigation activities
As part of its investigations, AGIFER may process, as applicable:
- the names and surnames of persons involved;
- the Personal Numeric Code (CNP) and/or other identification data, where necessary and permitted by law;
- domicile and contact details;
- the position held, the authorisation to exercise the position, and the duties specified in the job description or in specific regulations;
- information concerning medical and psychological fitness, where relevant and where processing is permitted by law;
- certificates and information concerning the assessment of professional competences;
- information provided in investigation questionnaires, statements and during interviews/questioning of persons involved or witnesses;
- data and information contained in on-board recording devices, voice message recording equipment, and records concerning the operation of signalling and traffic control systems;
- other relevant information, records and evidence that are strictly necessary for the conduct of the investigation and held by the infrastructure manager/administrator, railway transport operators, entities responsible for maintenance, the Romanian Railway Safety Authority, or other competent entities, in accordance with the law.
The data are used for the purpose of conducting the investigation, establishing the circumstances and causes of accidents or incidents, verifying matters relevant to railway safety and, where appropriate, formulating safety recommendations. The purpose of the investigation is to improve railway safety and prevent similar occurrences and is not to apportion blame or liability.
2. Public relations, petitions and handling of complaints
In managing petitions, complaints, requests, correspondence, requests for public-interest information submitted pursuant to Law no. 544/2001 on free access to information of public interest, and forms made available by AGIFER, the following may be processed:
- name and surname;
- signature, where applicable;
- telephone number, e-mail address, domicile/residence or correspondence address;
- the company/organisation represented, where relevant;
- the content of the request, petition, complaint or correspondence and the attached documents;
- where provided for by law, the series and number of the identity document and/or the CNP;
- other data provided by the data subject and necessary for handling the request.
These data are used to register, analyse and resolve requests and to communicate responses, as well as to fulfil the related legal obligations.
3. Human resources management and fulfilment of integrity obligations
AGIFER processes personal data necessary for the recruitment and selection of personnel, organisation of competitions and examinations, conclusion, performance, amendment and termination of employment or service relationships, management of personnel files, payroll, granting of entitlements, professional training and assessment, and fulfilment of other legal obligations in the field of human resources.
Depending on the activity and legal requirements, identification and contact data, professional and educational information, family-status information where relevant for statutory entitlements, salary and financial information, as well as health data may be processed, insofar as such data are necessary and permitted by law.
4. Economic and financial-accounting activities
As part of economic and financial-accounting activities, data necessary for payroll, making payments, reimbursement of expenses, management of financial entitlements, recovery of receivables, fulfilment of tax and financial-accounting obligations, and performance of other operations required by law may be processed.
5. Conclusion and performance of contracts and procurement activities
As part of procurement procedures and the conclusion and performance of contracts concerning AGIFER's activities or the provision of goods and services, the following may be processed:
- the names and surnames of legal or authorised representatives and their positions;
- handwritten or electronic signatures, as applicable;
- professional contact details and the address of the registered office or place of business;
- the names, qualifications and other professional data of persons nominated in bids, where relevant;
- data of persons designated to sign or perform contracts and of contact persons;
- other data necessary to fulfil legal or contractual obligations.
6. Occupational health and safety activities
For the purpose of fulfilling legal obligations in the field of occupational health and safety, AGIFER may process names and surnames, identification data, position, domicile/residence, contact details, health information and other data required by applicable legislation, only to the extent that such data are necessary and permitted by law.
IV. Sources of personal data
Depending on the activity, personal data may be obtained:
- directly from the data subject;
- from their representatives;
- from employers, economic operators, infrastructure administrators/managers, transport operators or other entities involved in activities falling within AGIFER's duties;
- from public authorities and institutions;
- from other natural or legal persons who lawfully provide information to AGIFER;
- from documents, records, recordings, evidence and information transmitted or made available to AGIFER in the exercise of its statutory duties.
Where data are not obtained directly from the data subject, the information is provided under the conditions of Article 14 of the GDPR, taking into account the exceptions provided therein.
V. Recipients of personal data
Data are primarily used by AGIFER personnel and organisational structures whose duties are related to the purpose for which the data were collected. Under the conditions and within the limits established by law, data may, where applicable, be disclosed to:
- the data subject or their representatives;
- authorised structures and persons within AGIFER;
- contractual partners/processors, where access to the data is necessary and appropriately regulated;
- auditors and control bodies;
- investigative and criminal prosecution authorities and courts;
- competent public authorities and institutions;
- national or European bodies and entities to which AGIFER is legally required or authorised to transmit information in the context of its investigation activities;
- other recipients, only in situations permitted or required by law.
Personal data are not disclosed to third parties for purposes incompatible with those for which they were collected, except in situations permitted or required by law.
VI. Mandatory or optional nature of providing data
In certain situations, the provision of personal data is mandatory because it results from a legal provision, is necessary for the performance of AGIFER's duties, for resolving a request or complaint, or for concluding or performing a contract. In other situations, providing the data may be optional.
Where the provision of certain data is mandatory or constitutes a necessary condition for carrying out a procedure, the data subject will be duly informed. Failure to provide the necessary data may, as applicable, make it impossible to resolve a request, participate in a recruitment/competition procedure, conclude or perform a contract, or enable AGIFER to fulfil a legal obligation or duty.
VII. Data retention period
Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected and to comply with the legal obligations applicable to AGIFER.
Retention periods are established according to the nature of the documents and activities, the applicable legal provisions and the institution's records retention schedule. Once the applicable periods have expired, documents and data are retained, archived, selected or deleted, as appropriate, in accordance with National Archives Law no. 16/1996, republished, as subsequently amended and supplemented, and with applicable internal procedures.
Investigation files are archived in accordance with the legislation and procedures specific to investigation activities.
VIII. Rights of data subjects
Under the conditions provided by the GDPR and depending on the legal basis for processing, data subjects may, as applicable, have the following rights:
- the right of access to personal data and to information concerning their processing;
- the right to rectification of inaccurate data and completion of incomplete data;
- the right to erasure of data, in the cases and under the conditions provided for in Article 17 of the GDPR;
- the right to restriction of processing, under the conditions of Article 18 of the GDPR;
- the right to data portability, where the conditions of Article 20 of the GDPR are met;
- the right to object, where applicable under Article 21 of the GDPR;
- the right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal;
- the right not to be subject to a decision based solely on automated processing, including profiling, under the conditions of Article 22 of the GDPR;
- the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing – ANSPDCP;
- the right to an effective judicial remedy, under the conditions established by law.
The rights provided by the GDPR are not absolute. Their exercise may be subject to conditions, limitations or exceptions provided by the GDPR and applicable legislation. In particular, the right to erasure does not apply insofar as processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for archiving purposes under the conditions established by law, or for the establishment, exercise or defence of legal claims before a court.
IX. Exercise of rights and handling of requests
To exercise rights relating to personal data protection, the data subject may submit a request to AGIFER or to the Data Protection Officer at:
Romanian Railway Investigation Agency – AGIFER
Calea Griviței no. 393, Sector 1, Bucharest
DPO E-mail:
The request must contain the information necessary to identify the data subject and to understand the subject matter of the request. Where there are reasonable doubts regarding the identity of the applicant, AGIFER may request additional information necessary to confirm the identity, in accordance with the GDPR.
AGIFER will respond within one month of receiving the request. In the situations provided for by the GDPR, this period may be extended by a maximum of two months, and the data subject will be informed of the extension and the reasons for it.
If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the National Supervisory Authority for Personal Data Processing – ANSPDCP. Information on how to lodge a complaint is available on the authority's website, www.dataprotection.ro. This right is without prejudice to your right to bring proceedings before the competent courts.
X. Security of personal data
AGIFER adopts appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or unauthorised access, whether accidental or unlawful, taking into account the nature of the data, the context and purposes of the processing, and the risks to the rights and freedoms of natural persons.
In the event of a personal data breach, AGIFER applies the measures provided by the GDPR concerning the documentation of the incident and, where the legal conditions are met, notification of the supervisory authority and communication to the data subjects.
XI. AGIFER website, online forms, cookies and external links
The processing of data associated with the use of cookies on the AGIFER website is described in the dedicated Cookie Policy available on the institution's website.
The website may contain links to websites, platforms or applications operated by other entities. AGIFER is not responsible for the content or data protection policies applied by those websites or external services. Consultation of the respective operators' privacy policies is recommended.
XII. Updates to this notice
AGIFER may update this Privacy Notice whenever legislative, organisational or technical changes occur, or when there are changes to personal data processing activities.
The updated version will be published on the institution's website.
Date of last update: 24 August 2026
