ANSPDCP (Romania) - PPC Energy Muntenia SA
| ANSPDCP - PPC Energy Muntenia SA | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 10.02.2025 |
| Fine: | 14,925 RON |
| Parties: | PPC Energy Muntenia SA |
| National Case Number/Name: | PPC Energy Muntenia SA |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO) |
| Initial Contributor: | elu |
The DPA fined an energy provider RON 14,925 (€3,000) due to unlawful processing of the data subject’s telephone number for marketing calls.
English Summary
Facts
A data subject advanced a complaint before the DPA against the controller, energy provider PPC Energy Muntenia SA. The complaint concerned marketing calls by an operator of the controller.
The data subject advanced an access request, as per Article 15 GDPR, to which the controller did not reply. The data subject advanced a second access request. This time the controller replied, but in an incomplete manner.
The DPA decided to investigate the matter further.
Holding
The DPA held that the controller processed personal data, i.e. the telephone number, of the data subject for marketing and advertising purposes and that there was no legal basis for such processing.
Thus, the DPA found a violation of Article 5(1)(a) and (b) GDPR and Article 6 GDPR. Consequently, the DPA imposed a fine of RON 9,950 (€2,000).
Moreover, the DPA found that the controller did not properly manage the access requests of the data subject as per Article 15 GDPR.
Thus, the DPA found a violation of Article 12(3) and (4) GDPR and of Article 15 GDPR. Consequently, the DPA imposed a fine of RON 4,975 (€1,000).
Additionally, the DPA ordered the controller to impose the following corrective measures:
- to ensure that the data collected for explicit and legitimate purposes is processed in compliance with the GDPR;
- to put into place a procedure ensuring exhaustive replies to access requests.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
10.02.2025 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing, completed, in January of this year, an investigation at the operator PPC Energie Muntenia SA and found a violation of the provisions of art. 5 para. (1) letters a) and b), art. 6 and art. 12 para. (3) and (4) of the General Data Protection Regulation (GDPR), in conjunction with art. 15 of the GDPR. As such, the operator was sanctioned with a fine, as follows: - fine in the amount of 9,950 lei, the equivalent of 2,000 EURO for violation of art. 5 para. (1) letters a) and b) and art. 6 of the GDPR; - fine in the amount of 4,975 lei, equivalent to 1,000 EURO for the violation of art. 12 para. (3) and (4), in conjunction with art. 15 of the GDPR The investigation was initiated following a complaint by which the petitioner claimed that he had been contacted by telephone, for marketing purposes, by a partner of the operator. In this context, the petitioner addressed the operator with a request through which he exercised his rights of access and opposition provided for by the GDPR, to which he did not receive a response. Subsequently, the petitioner addressed a new request, but was not satisfied with the response received from the operator. During the investigation, the National Supervisory Authority found that PPC Energie Muntenia SA illegally processed the personal data (telephone number) of the petitioner, by making them available to a partner, for marketing and advertising purposes, without a valid legal basis for the processing, thus violating the provisions of art. 5 para. (1) let. a) and b) and of art. 6 of Regulation (EU) 2016/679. At the same time, it was found that the operator did not properly manage the requests through which the petitioner exercised his rights of access and opposition provided for by the GDPR, the response received not being in accordance with the provisions of art. 12 para. (3) and (4) of Regulation (EU) 2016/679, in conjunction with art. 15 of Regulation (EU) 2016/679. At the same time, pursuant to the provisions of art. 58 para. (2) letters c) and d) of Regulation (EU) 2016/679, the operator PPC Energie Muntenia SA was ordered to take the following corrective measures: to ensure compliance with the GDPR of personal data processing operations, so that data collected for specified, explicit and legitimate purposes are not subsequently processed in a manner incompatible with these purposes; to send a complete response in accordance with the applicable legal provisions to the requests for exercising the right of access of the applicant. Legal and Communication Department A.N.S.P.D.C.P.
