ANSPDCP (Romania) - Fine against CROWD ENTERTAINMENT LIMITED

ANSPDCP - Fine against CROWD ENTERTAINMENT LIMITED
Authority:	ANSPDCP (Romania)
Jurisdiction:	Romania
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 5(2) GDPR Article 24 GDPR Article 25 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:
Published:	28.04.2026
Fine:	178,332 RON
Parties:	CROWD ENTERTAINMENT LIMITED
National Case Number/Name:	Fine against CROWD ENTERTAINMENT LIMITED
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Romanian
Original Source:	ANSPDCP (in RO)
Initial Contributor:	ds

The DPA fined a gambling-platform operator €35,000 for unlawfully processing a data subject’s phone number without proper verification during account registration and for collecting excessive ID documents when handling the data subject’s request.

English Summary

Facts

The Romanian DPA (ANSPDCP) launched an investigation into CROWD ENTERTAINMENT LIMITED, a gambling-platform operator, (the controller) following a complaint by a data subject. The data subject claimed that they received a commercial SMS from the controller even though they hadn’t consented to the use of their phone number for marketing purposes.

During the investigation, the DPA found that the controller collected the telephone number of the data subject when another person created an online gambling account on one of its platforms. The controller hadn’t verified the accuracy of the data provided during the account-registration process.

Furthermore, the DPA found that when the controller handled the data subject’s request trying to identify the source from which their phone number had been collected and to obtain proof of consent for marketing, it collected and stored identity documents relating to that data subject, namely a copy of the identity document and a selfie photo.

Holding

The DPA held that the controller unlawfully processed the data subject’s phone number, without first verifying the accuracy of the data provided during the creation of the account, in violation of Article 5(1)(a) GDPR, Article 5(1)(d) GDPR and Article 5(2) GDPR. Therefore, the DPA fined the controller RON 101,904 (€20,000).

The DPA also noted that the controller unlawfully collected and stored documents containing the data subject’s personal data although these weren’t necessary for handling their request. Consequently, the DPA fined the controller RON 76,428 (€15,000) for infringement of the Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(2) GDPR.

Moreover, the DPA ordered the controller to adopt appropriate technical and organisational measures, under Article 24 GDPR and Article 25 GDPR, including through staff training, to ensure compliance with the Article 5 GDPR principles. In particular, the controller was ordered to ensure the collection and further processing of accurate personal data during gambling-account registration, and to avoid the excessive collection and storage of personal data or documents.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.

28.04.2026

Fine for violation of the GDPR

 

The National Supervisory Authority for Personal Data Processing completed, in March 2026, an investigation at the operator CROWD ENTERTAINMENT LIMITED and found a violation of the provisions of art. 5 para. (1), letter. a), d) and para. (2), as well as art. 5 para. (1) letter. a), c) and para. (2) of Regulation (EU) 679/2016.

As such, the operator was sanctioned with:

a fine in the amount of 101,904 lei (equivalent to 20,000 euros) for the violation of art. 5 para. (1) letter. a), d) and para. (2) of Regulation (EU) 2016/679. fine of 76,428 lei (equivalent to 15,000 euros) for violating the provisions of art. 5 para. (1) let. a), c) and (2) of Regulation (EU) 2016/679.

The investigation was initiated following a complaint from a petitioner who claimed to have received a commercial communication via SMS from the operator Crowd Entertainment Ltd (owner of gambling platforms), without the latter having given his consent to the use of the data for marketing purposes.

During the investigation, it was found that the operator collected the petitioner's phone number when another natural person created an online gaming account on one of its platforms, without verifying the accuracy of the data provided, thus violating the provisions of art. 5 para. (1) let. a), d) and para. (2) of Regulation (EU) 679/2016.

At the same time, the investigation found that the operator illegally and excessively collected and stored documents containing the personal data of the petitioner (copy of the identity document and a "selfie" photo), in the context of resolving the petitioner's request to identify the source of the collection of his phone number and proof of obtaining consent for use for marketing purposes.

Thus, the operator was sanctioned with a misdemeanor fine, for violating the provisions of art. 5 para. (1) let. a), c) and para. (2) of Regulation (EU) 679/2016.

Also, the operator was ordered to take the following corrective measures:

to ensure compliance with Regulation (EU) 2016/679 of the personal data processing operations, by adopting the necessary technical and organizational measures to ensure compliance with the principles of personal data processing provided for in art. 5, in accordance with art. 24 and 25 of the Regulation, so as to ensure the collection and subsequent processing of accurate personal data of data subjects who wish to register an account on the gambling platforms of this operator; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including training of its own personnel, to ensure compliance with the principles of personal data processing provided for in art. 5, in accordance with art. 24 and 25 of the Regulation, so as to ensure the collection and subsequent processing of only personal data that are necessary to achieve the purposes of the processing and to avoid excessive collection and storage of data or documents containing personal data.

 

Legal and Communication Department

A.N.S.P.D.C.P