ANSPDCP (Romania) - 10.12.2025
| ANSPDCP - 10.12.2025 | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 15(3) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 10.12.2025 |
| Fine: | 76,333 RON |
| Parties: | Crowd Entertainment Limited |
| National Case Number/Name: | 10.12.2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | dt |
The DPA issued a fine of RON 76,333 (€15,000) to an online gambling operator for an incomplete response to a data subject’s access inquiry regarding their player accounts and self-exclusion requests.
English Summary
Facts
Crowd Entertainment Limited (the controller) is an online gambling operator.
A data subject requested access to their personal data processed by the controller, referring to the personal data linked to their player accounts registered on the controller’s platforms, including the information related to their self-exclusion requests. However, the data subject was not satisfied with the response received to their request. Therefore, they filed a complaint with the Romanian DPA (ANSPDCP).
Holding
The DPA launched an investigation following the data subject’s complaint. It noted that the controller did not demonstrate it communicated in written form and within the prescribed time limit a complete and appropriate response to the data subject’s access request. Thus, the DPA found an infringement of Article 12(3) GDPR, Article 12(4) GDPR, Article 15(1) GDPR and Article 15(3) GDPR.
Therefore, the DPA issued a fine of RON 76,333 (€15,000) to the controller. Moreover, the DPA ordered the controller to communicate to the data subject a complete response to their request and to adopt the necessary technical and organisational measures in order to be able to analyse and respond appropriately to data subjects’ rights requests under the GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
10.12.2025 Fine for violation of the GDPR The National Supervisory Authority for Personal Data Processing completed, in November 2025, an investigation at the operator Crowd Entertainment Limited and found a violation of the provisions of art. 12 para. (3) and (4) in relation to art. 15 para. (1) and (3) of Regulation (EU) 2016/679. As such, the operator was fined a fine of 76,333 lei (equivalent to 15,000 euros). The investigation was initiated following a complaint filed by a data subject dissatisfied with the way in which his request for access to personal data was handled by Crowd Entertainment Limited. During the investigation, the National Supervisory Authority for Personal Data Processing found that the operator did not present evidence showing that it had communicated, in writing and within the legal deadline, a complete and appropriate response to the request of the petitioner requesting access to his personal data related to the player accounts registered on the platforms owned by the operator, including information regarding his self-exclusion requests. Consequently, art. 12 para. (3)-(4), in relation to art. 15 para. (1) and (3) of Regulation (EU) 2016/679, were violated. At the same time, the following corrective measures were ordered against the operator: to send a complete response to the petitioner's request, by communicating all the information requested by his requests, in relation to the provisions of art. 15 para. (1) and (3) of Regulation (EU) 2016/679; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of training the personnel designated for this purpose, with the appropriate involvement of the data protection officer, so that the operator is able to analyze, correctly resolve and adequately respond to requests by which data subjects exercise their rights, within the time limits according to the conditions provided for in art. 12-23 of Regulation (EU) 2016/679. Legal and Communication Department A.N.S.P.D.C.P.
