ANSPDCP (Romania) - Briza Land SRL

ANSPDCP (Romania) - Briza Land SRL
Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	24.02.2022
Published:	10.03.2022
Fine:	2000 EUR
Parties:	n/a
National Case Number/Name:	Briza Land SRL
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	Cesar Manso-Sayao

The Romanian DPA issued a fine of approximately €2000 against a real estate agency for not granting a data subject's access request in violation of Article 15 GDPR.

English Summary

Facts

A data subject filed a complaint against a real estate agency (Briza Land SRL) for not adequately granting their request to exercise their right of access under Article 15 GDPR. The controller did not communicate to the data subject the information requested regarding the processing of their personal data, in particular, the totality of personal data processed, the source of this data, as well as the recipients of the data.

Holding

The Romanian DPA initiated an investigation, and found that the real estate agency had indeed not responded to the request and failed to grant the information requested by the data subject, in violation of Article 15 GDPR. Therefore, the DPA issued a fine of approximately €2000 (9892.6 lei in local currency) against the controller.

The DPA also issued a corrective measure against the agency, ordering it to communicate to the data subjected all the information they had requested regarding the processing of their personal data, and to do so in 5 working days from the communication of the decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

10.03.2022

RGPD fine



The National Supervisory Authority completed on 24.02.2022 an investigation at the operator Briza Land S.R.L. and found a violation of the provisions of art. 15 of the General Data Protection Regulation (RGPD).

The operator Briza Land S.R.L. was sanctioned with a fine in the amount of 9892.6 lei, the equivalent of the amount of 2000 EURO.

The investigation was initiated as a result of a complaint by which the petitioner complained that he was not satisfied with the response received from the operator to his request to exercise the right of access provided by art. 15 of the General Data Protection Regulation.

During the investigation, it was found that the operator did not communicate to the petitioner all the information regarding the processing of his personal data (such as the personal data processed, the source of the data, the recipients of the data), thus violating the provisions of art. 15 of the RGPD.

In this context, we reiterate that art. 15 of the RGPD, provides that “the data subject has the right to obtain from the operator a confirmation that personal data concerning him or her are being processed or not and, if so, access to those data and to the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or categories of recipients to whom personal data have been or are to be disclosed, in particular recipients from third countries or international organizations;

d) where possible, the period for which personal data are expected to be stored or, if this is not possible, the criteria used to establish this period;

e) the existence of the right to request the operator to rectify or delete personal data or to restrict the processing of personal data relating to the data subject or the right to oppose the processing;

f) the right to lodge a complaint with a supervisory authority;

g) in case the personal data are not collected from the data subject, any available information regarding their source;

h) the existence of an automated decision-making process including profiling, referred to in Article 22 (1) and (4), as well as, at least in those cases, relevant information on the logic used and on the importance and expected consequences of such processing for the data subject. "

At the same time, the corrective measure was applied to the controller to communicate to the petitioner all the information regarding the processing of his personal data, including the personal data processed, the source of the data, the recipients of the data, following his request to exercise the right of access to data. according to art. 15 of the RGPD, within 5 working days from the communication of the minutes.





A.N.S.P.D.C.P.