ANSPDCP (Romania) - Fine against a Romanian politician
| ANSPDCP - Fine against a Romanian politician | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12 GDPR Article 13 GDPR Article 14 GDPR art. 4(5) lit. a) and b) |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 16.07.2025 |
| Fine: | 50,286.80 RON |
| Parties: | n/a |
| National Case Number/Name: | Fine against a Romanian politician |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | ap |
The DPA fined a politician a total of RON 50,286.80 (€10,000) for storing cookies on their website without the data subjects’ consent and for failing to inform visitors about the processing of their data when interacting with the website’s contact form.
English Summary
Facts
A Romanian politician is the controller. After receiving a complaint, the DPA carried out an investigation on the controller’s website. The DPA found that from 6 December 2024 to 3 April 2025, the website installed cookies without consent or knowledge of the data subjects.
Holding
The DPA considered this a violation of the GDPR and the national law implementing the ePrivacy Directive (Law No. 506/2004 concerning the processing of personal data and the protection of privacy in the electronic communications sector).
The DPA fined the controller RON 30,000 (€6,000) for setting cookies on the website without consent or knowledge of the data subjects. This was a violation of Article 4(5)(a) and (b) of Law No. 506/2004. In addition, the DPA fined the controller RON 20,286.80 (€4,000) for not informing the data subjects of the data processed through the website’s contact form (name, e-mail address and telephone number). This was a violation of Article 12, 13 and 14 GDPR.
The DPA fined the controller a total of RON 50,286.80 (€10,000).
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
16.07.2025 Sanctions The National Supervisory Authority for Personal Data Processing, completed, in June 2025, an investigation of the operator Georgescu Călin, during which it was found that the provisions of art. 4 para. (5) let. a) and b) of Law no. 506/2004 and of art. 12-14 of Regulation (EU) 2016/679 were violated. As such, the operator was sanctioned as follows: fine in the amount of 30,000 lei for violating the provisions of art. 4 para. (5) let. a) and b) of Law no. 506/2004; fine in the amount of 20,286.80 lei (the equivalent of 4,000 euros) for violating the provisions of art. 12-14 of Regulation (EU) 2016/679. The investigation was initiated following a complaint reporting a possible violation of Regulation (EU) 2016/679. During the investigation, it was found that, during the period 06.12.2024 - 03.04.2025, when accessing the operator's website, it was possible to store and access information stored on users' equipment, by installing cookie modules, without obtaining the users' express consent in advance and without them being informed, in accordance with the provisions of art. 4 para. (5) of Law no. 506/2004. As such, the operator was fined for violating the provisions of art. 4 para. (5) letters a) and b) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector. In this context, we specify that art. 4 para. (5) of the aforementioned normative act establishes the following: "(5) The storage of information or obtaining access to information stored in the terminal equipment of a subscriber or user is permitted only with the cumulative fulfillment of the following conditions: a) the subscriber or user in question has expressed his/her consent; b) the subscriber or user in question has been provided, prior to expressing consent, in accordance with the provisions of art. 12 of Law no. 677/2001, as subsequently amended and supplemented, with clear and complete information which: (i) shall be presented in an easily understandable language and shall be easily accessible to the subscriber or user; (ii) shall include mentions regarding the purpose of processing the information stored by the subscriber or user or the information to which he/she has access. In the event that the provider allows third parties to store or access information stored in the terminal equipment of the subscriber or user, the information in accordance with points (i) and (ii) will include the general purpose of the processing of this information by third parties and the way in which the subscriber or user can use the settings of the internet browsing application or other similar technologies to delete the stored information or to deny third parties access to this information.” On the other hand, the investigation also found that the operator Georgescu Călin did not inform the data subjects whose personal data were collected and processed through the contact form (surname, first name, e-mail, telephone number) available on its website, during the period 06.12.2024 - 03.04.2025, thus violating the provisions of art. 12-14 of Regulation (EU) 2016/679. As such, in relation to the criteria for individualizing the sanctions provided for in art. 83 of Regulation (EU) 2016/679, the operator was fined. Legal and Communication Department A.N.S.P.D.C.P.
