ANSPDCP (Romania) - 31.01.2024: Difference between revisions

Latest revision as of 16:14, 14 February 2024

ANSPDCP - 31.01.2024

Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 58(1)(a) GDPR Article 58(1)(e) GDPR Article 58(2)(d) GDPR Law 190/2018
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:
Published:	16.07.2036
Fine:	10,000 RON
Parties:	n/a
National Case Number/Name:	31.01.2024
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	Ro DPA (in RO)
Initial Contributor:	maxinescu

The Romanian DPA sanctioned the local municipality of 1st district, Bucharest, €2,010.38 for the failure to comply with the requests of the DPA to provide information and obtain access to personal data and information necessary for performing its tasks, pursuant to Article 58(1)(a) and (e) GDPR.

English Summary

Facts

The DPA initiated an investigation into the local municipality of the 1st district in Bucharest (the controller) after receiving several referrals alleging a possible infringement of the GDPR.

The notices regarded the financial incentives of the programme "Local measures to ensure energy needs and energy efficiency in households in Sector 1". By decisions of the Local Council, it was established how the inhabitants of Sector 1 could submit the necessary documents to benefit from the financial incentives of the programme: in physical format or via e-mail. However, the controller had made available also an online platform for data collection that had been purchased before the decision was approved by the Local Council.

Holding

During the investigation, the controller failed to respond to the Romanian DPA's repeated requests for information in accordance with the provisions of Article 58(1)(a) and (e) GDPR, which led to the DPA issuing a warning to the controller. At the same time, the DPA ordered the controller a remedial measure, namely, to provide all the requested information to the DPA.

Since the controller did not carry out the measures under the remediation plan within the deadline set by the authority, as the controller did not reply to the DPA request to provide the relevant documents and information, the latter imposed a fine of €2,010.38 for the failure to comply with the provisions of Article 58(1)(a) and (e) GDPR.

At the same time, during the investigation, in accordance with Article 58(2)(d) GDPR, the DPA also imposed on the controller the corrective measure to provide and communicate all the requested information, necessary to assess the aspects subject of the investigation.

Comment

Unfortunately, the Romanian DPA does not publish its full decisions.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

31.01.2024

Penalty for GDPR violation

The National Supervisory Authority for the Processing of Personal Data completed in December 2023 an investigation at the operator Sector 1 of the Municipality of Bucharest and found a violation of the provisions of art. 58 para. (1) lit. a) and e) from Regulation (EU) no. 2016/679 and art. 14 para. (5) lit. e) from Law no. 190/2018.

As such, the operator was penalized with a fine of 10,000 lei.

The investigation was started as a result of notifications that claimed a possible violation of the provisions of Regulation (EU) no. 2016/679.

Thus, the operator of Sector 1 of the Municipality of Bucharest, through the decisions of the Local Council, established the way in which the inhabitants of Sector 1 can submit the necessary documents to benefit from the financial incentives of the program "Local measures aimed at ensuring energy needs and improving the efficiency of energy consumption in households from Sector 1", respectively in physical format or on an e-mail address, established strictly for the purpose of implementing the program. However, Sector 1 of the Municipality of Bucharest made available to the beneficiaries an online platform, https://ticheteanticriza.primarias1.ro, for data collection, purchased before the draft decision was debated and approved by the Local Council.

During the investigation, the operator did not respond to the repeated requests for information sent by the National Authority for the Supervision of Personal Data Processing.

Therefore, as the operator did not provide the information requested by our institution, considering the operator's status as a public institution according to the provisions of Law no. 190/2018, he was sanctioned with a warning. At the same time, it was ordered to apply a remedial measure consisting in the provision/communication of all the requested information.

Since the operator of Sector 1 of the Municipality of Bucharest did not carry out the previously ordered measure through a remedial plan, within the deadline set by the authority, the investigation continued.

Considering that the operator did not prove the fulfillment of the ordered remedial measure, the National Supervisory Authority for the Processing of Personal Data fined Sector 1 of the Municipality of Bucharest for violating the provisions of art. 58 para. (1) lit. a) and lit. e) from Regulation (EU) no. 2016/679 and art. 14 para. (5) lit. e) from Law no. 190/2018.

At the same time, during the investigation, in accordance with the provisions of art. 58 para. (2) lit. d) from Regulation (EU) no. 2016/679, the National Supervisory Authority for the Processing of Personal Data applied to the operator the corrective measure to provide/communicate all the requested information, necessary for the resolution of the reported issues.

Legal and Communication Department

A.N.S.P.D.C.P.

@@ Line 65: / Line 65: @@
 }}
-The local municipality of 1st district, Bucharest, was sanctioned for the failure to comply with the requests of the DPA to provide information and obtain access to personal data and information necessary for performing its attributions, in accordance with the provisions of Article 58 (1) (a) and (e) GDPR.
+The Romanian DPA sanctioned the local municipality of 1st district, Bucharest, €2,010.38 for the failure to comply with the requests of the DPA to provide information and obtain access to personal data and information necessary for performing its tasks, pursuant to [[Article 58 GDPR#1|Article 58(1)(a) and (e) GDPR]].
 == English Summary ==
 === Facts ===
-The DPA initiated an investigation to the local municipality of 1st district in Bucharest following the receiving of several referrals alleging a possible infringement of GDPR.
+The DPA initiated an investigation into the local municipality of the 1st district in Bucharest (the controller) after receiving several referrals alleging a possible infringement of the GDPR.
-The local municipality, pursuant to the issuance of several decisions by the Local Council in this respect, has determined how the inhabitants of 1st district, Bucharest can submit the necessary documents to benefit from the financial incentives of the program "Local measures to ensure energy needs and energy efficiency in households in Sector 1", respectively in physical format or by e-mail address.
-For this purpose, the local municipality made available to all interested individuals, beneficiaries of this program, an online platform, https://ticheteanticriza.primarias1.ro, in order to have all data collected and processed for the purpose of implementing the program.
+The notices regarded the financial incentives of the programme "Local measures to ensure energy needs and energy efficiency in households in Sector 1". By decisions of the Local Council, it was established how the inhabitants of Sector 1 could submit the necessary documents to benefit from the financial incentives of the programme: in physical format or via e-mail. However, the controller had made available also an online platform for data collection that had been purchased before the decision was approved by the Local Council.
 === Holding ===
-During the investigation, the DPA assessed that the online platform had actually been purchased before the draft decision of the Local Council in relation to this online platform was debated and approved by the Local Council. Furthermore, the controller failed to respond to the DPA to repeated requests for information, in accordance with the provisions of Article 58 (1) (a) and (e) GDPR.
+During the investigation, the controller failed to respond to the Romanian DPA's repeated requests for information in accordance with the provisions of [[Article 58 GDPR#1|Article 58(1)(a) and (e) GDPR]], which led to the DPA issuing a warning to the controller. At the same time, the DPA ordered the controller a remedial measure, namely, to provide all the requested information to the DPA.
-Considering the specific capacity of the controller, respectively a public entity in accordance with the provisions of Law no. 190/2018, since the controller failed to provide the information, it was sanctioned with a warning. Indeed, in accordance with Article 13 (1) of Law 190/2018, in case a violation of GDPR is assessed by the DPA, the latter shall firstly impose the sanction of warning, attaching also to the report of findings and sanctions a remediation plan to be followed and implemented by the controller.
-Since the local municipality of 1st district, Bucharest did not carry out the measures under the remediation plan, within the deadline set by the authority, the investigation of the DPA further continued. Furthermore, as the controller failed to comply with DPA requests of documents and information, the latter imposed a fine of 10,000 lei for the failure to comply with the provisions of Article 58 (1) (a) and (e) of GDPR and Art. 14 para. (5) letter e) of Law 190/2018.
+Since the controller did not carry out the measures under the remediation plan within the deadline set by the authority, as the controller did not reply to the DPA request to provide the relevant documents and information, the latter imposed a fine of €2,010.38 for the failure to comply with the provisions of [[Article 58 GDPR#1|Article 58(1)(a) and (e) GDPR]].
-At the same time, during the investigation, in accordance with the provisions of Article 58 (2) (d) of GDPR, the DPA also imposed to the controller the corrective measure to provide and communicate all the requested information, necessary to assess the aspects subject of the investigation.
+At the same time, during the investigation, in accordance with [[Article 58 GDPR#2d|Article 58(2)(d) GDPR]], the DPA also imposed on the controller the corrective measure to provide and communicate all the requested information, necessary to assess the aspects subject of the investigation.
 == Comment ==