ANSPDCP (Romania) - Fine against SC Wabag Water Services SRL
| ANSPDCP - Fine against SC Wabag Water Services SRL | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(2) GDPR Article 6 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 09.08.2022 |
| Fine: | 1000 EUR |
| Parties: | n/a |
| National Case Number/Name: | Fine against SC Wabag Water Services SRL |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | Diana Rosu |
The Romanian DPA fined an employer €1,000 after it unlawfully processed its employees' personal data by making an appointment on their behalf for a COVID-19 vaccination without their consent.
English Summary
Facts
A controller (SC Wabag Water Services SRL) registered and made an appointment on the COVID-19 vaccination website on behalf of its employees without their consent. Consequently, one of the affected data subjects (the controller's employee) filed a complaint with the Romanian DPA.
Holding
The Romanian DPA found that the controller unlawfully processed the data of its employees in order to register and schedule an appoint on their behalf on the COVID-19 vaccination platform. The controller did not obtain valid consent and did not prove that it was subject to an obligation which made that did not require consent for processing the concerned personal data.
As such, the controller was found in breach of Article 5(1)(a), 5(2) and 6 GDPR and fined approximately €1,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
In June 2022, the National Supervisory Authority completed an investigation at the operator SC Wabag Water Services SRL and found a violation of the provisions of art. 5 para. (1) lit. a) and para. (2) and of art. 6 of the General Data Protection Regulation.
The operator SC Wabag Water Services SRL was fined 4,945.40 lei (the equivalent of 1000 EURO).
The investigation was started as a result of receiving complaints from a petitioner claiming that her personal data was used by her own employer (SC Wabag Water Services SRL), without her consent, in order to register and program her on the national platform of vaccination for carrying out the vaccine against Covid-19.
During the investigation, it was noted that the operator SC Wabag Water Services SRL used the personal data of the petitioner (employee of the operator) for the purpose of registering and scheduling her on the national scheduling platform for vaccination against Covid-19, in the year 2021, without doing proof of the existence of the petitioner's consent and without the existence of another situation in which consent is not necessary, thus violating the provisions of art. 5 para. (1) lit. a) and para. (2) and of art. 6 of Regulation (EU) 2016/679.
In this context, we emphasize that art. 5 of Regulation (EU) 2016/679 establishes a series of principles that must be respected in the context of data processing. Among them is the one regarding the processing of data in a legal, fair and transparent manner towards the data subject ("legality, fairness and transparency"), this being provided for in art. 5 para. (1) lit. a) from the regulation.
At the same time, art. 5 para. (2) of Regulation (EU) 2016/679 provides that the operator is responsible for compliance with the processing principles and can demonstrate this compliance (principle of responsibility).
