ANSPDCP (Romania) - PPC Energie Muntenia S.A.
| ANSPDCP - PPC Energie Muntenia SA | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6 GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | |
| Published: | 10.02.2025 |
| Fine: | 14,925 RON |
| Parties: | PPC Energie Muntenia SA |
| National Case Number/Name: | PPC Energie Muntenia SA |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO) |
| Initial Contributor: | elu |
The DPA fined an energy provider RON 14,925 (€2,998) due to the processing of the data subject´s telephone number for marketing and advertising purposes without an appropriate legal basis.
English Summary
Facts
A data subject advanced a complaint before the DPA against the controller, an energy supply company. The complaint concerned marketing calls by an operator of the controller. The data subject asked the operator how he got their contact and advanced an access request as per Article 15 GDPR, to which no answer was given. The data subject reiterated their request, the controller replied but the data subject was not satisfied by the reply.
Holding
The DPA found that the controller illegally processed the personal data, i.e. the phone number, of the data subject by making them available to a partner. This making available of the phone number happened solely for marketing and advertising reasons. However, the controller did so without any legal basis. This entailed a violation of Article 5(1)(a) and (b) GDPR, as well as Article 6 GDPR.
Moreover, the DPA considered that the controller did not properly manage the access request advanced by the data subject and thus violated Article 12(3) and (4) GDPR, as well as Article 15 GDPR.
Therefore, the DPA deemed it appropriate to impose a twofold fine:
- First, a fine of RON 9,950 (€2,000) for the violation of Article 5(1)(a), (b) GDPR and Article 6 GDPR;
- Second, a fine of RON 4,975 (€1,000) for the violation of Article 12(3) and (4) GDPR and Article 15 GDPR.
Additionally, the DPA recommended the controller to take the following actions:
- To ensure that the data collected is processed in compliance with the GDPR; and
- To submit a complete and applicable legal provision to access requests.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
10.02.2025 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing, completed, in January of this year, an investigation at the operator PPC Energie Muntenia SA and found a violation of the provisions of art. 5 para. (1) letters a) and b), art. 6 and art. 12 para. (3) and (4) of the General Data Protection Regulation (GDPR), in conjunction with art. 15 of the GDPR. As such, the operator was sanctioned with a fine, as follows: - fine in the amount of 9,950 lei, the equivalent of 2,000 EURO for violation of art. 5 para. (1) letters a) and b) and art. 6 of the GDPR; - fine in the amount of 4,975 lei, equivalent to 1,000 EURO for the violation of art. 12 para. (3) and (4), in conjunction with art. 15 of the GDPR The investigation was initiated following a complaint by which the petitioner claimed that he had been contacted by telephone, for marketing purposes, by a partner of the operator. In this context, the petitioner addressed the operator with a request through which he exercised his rights of access and opposition provided for by the GDPR, to which he did not receive a response. Subsequently, the petitioner addressed a new request, but was not satisfied with the response received from the operator. During the investigation, the National Supervisory Authority found that PPC Energie Muntenia SA illegally processed the personal data (telephone number) of the petitioner, by making them available to a partner, for marketing and advertising purposes, without a valid legal basis for the processing, thus violating the provisions of art. 5 para. (1) let. a) and b) and of art. 6 of Regulation (EU) 2016/679. At the same time, it was found that the operator did not properly manage the requests through which the petitioner exercised his rights of access and opposition provided for by the GDPR, the response received not being in accordance with the provisions of art. 12 para. (3) and (4) of Regulation (EU) 2016/679, in conjunction with art. 15 of Regulation (EU) 2016/679. At the same time, pursuant to the provisions of art. 58 para. (2) letters c) and d) of Regulation (EU) 2016/679, the operator PPC Energie Muntenia SA was ordered to take the following corrective measures: to ensure compliance with the GDPR of personal data processing operations, so that data collected for specified, explicit and legitimate purposes are not subsequently processed in a manner incompatible with these purposes; to send a complete response in accordance with the applicable legal provisions to the requests for exercising the right of access of the applicant. Legal and Communication Department A.N.S.P.D.C.P.
