ANSPDCP (Romania) - 03.08.2023
| ANSPDCP - 03.08.23 (Med Life) | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12(4) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 03.08.2023 |
| Fine: | 2,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 03.08.23 (Med Life) |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (Romania) (in RO) |
| Initial Contributor: | n/a |
Romanian DPA fined Med Life SA for the violations of Article 12(4) GDPR and Article 15(3) GDPR. Med Life SA was fined 9,839.6 RON, equivalent to €2,000 EUR.
English Summary
Facts
The DPA received a complaint that the controller had violated the complainant's right of access by refusing to disclose certain video recordings from the reception of one of its hospitals.
Holding
The Romanian DPA found that the controller, Med Life SA, was in violation of Articles 12(4) and 15(3) GDPR.
Firstly, the controller did not respond to the data subject’s access request, and had failed to provide her with the video recordings requested. This amounted to a breach of Article 15(3) GDPR.
Secondly, the DPA found a violation of Article 12(4) GDPR. The controller did not fulfil the access request within the one month prescribed period under Article 12(2) GDPR. Under Article 12(4) GDPR when a controller does not take action on the request of the data subject “it shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility to lodge a complaint with a supervisory authority and to lodge a judicial remedy.” The controller did not inform the data subject of this, and thus was in violation of Article 12(4) GDPR.
As a result of the violations, the Romanian DPA ordered the controller to comply with the Article 15(3) GDPR access requests and was fined 9,839.6 RON, equivalent to €2,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
08/03/2023 Penalty for GDPR violation The National Supervisory Authority for the Processing of Personal Data completed in July of the current year an investigation at the operator Med Life SA and found a violation of the provisions of art. 12 para. (4) and of art. 15 para. (3) of Regulation (EU) 679/2016 (RGPD). As such, Med Life SA was fined 9,839.6 lei, the equivalent of 2,000 EURO. The sanction was applied as a result of a complaint claiming that the operator violated the petitioner's right of access by refusing to communicate certain video recordings from the reception of one of his hospitals. In the course of the investigation, the National Supervisory Authority found that the operator Med Life SA did not send the petitioner the video recordings requested by her request to exercise the right of access, thus violating the provisions of art. 15 para. (3) of the GDPR. Also, the operator violated the provisions of art. 12 para. (4) in conjunction with art. 15 para. (3) of the GDPR since the answers sent to the petitioner did not contain information about the possibility of filing a complaint before the National Authority for the Supervision of Personal Data Processing and introducing a judicial appeal. In this context, we remind you that in art. 12 para. (4) of Regulation (EU) 679/2016 provides that "If it does not take measures regarding the request of the data subject, the operator informs the data subject, without delay and within no more than one month after receiving the request, about the reasons for which he does not take measures and the possibility of filing a complaint before a supervisory authority and introducing a judicial appeal." At the same time, the operator was also given the corrective measure to respond to the petitioner's requests, by communicating the copy of his personal data provided by art. 15 para. (3) of the RGPD, respectively of the requested video recordings, for the time interval in which the petitioner was in the premises of the operator's hospital, respecting, as the case may be, the provisions of art. 15 para. (4) of the GDPR. Legal and Communication Department A.N.S.P.D.C.P.
