ANSPDCP (Romania) - Sanction on cross border processing
| ANSPDCP - Sanction on cross border processing | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 6(1) GDPR Article 12(1) GDPR Article 14 GDPR Article 15 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 21.05.2025 |
| Fine: | 59,726 RON |
| Parties: | n/a |
| National Case Number/Name: | Sanction on cross border processing |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | ap |
The DPA fined a market research agency RON 59,726 (€12,000) for a failure to inform data subjects about the processing of their personal data and for a violation of the data subjects’ right of access.
English Summary
Facts
Two data subjects filed a complaint against a controller (Data Diggers Market Research SRL). This case concerned cross border processing, as the data subjects lived in different Member States than the controller. The Romanian DPA was the lead supervisory authority in accordance with Articles 56 and 61 GDPR because the headquarters of the controller is located in Romania.
Holding
The Romanian DPA fined the controller RON 59,726 (€12,000) in total. RON 24,886 (€5,000) for the violation of Article 6(1) GDPR, meaning the controller processed the data unlawfully. RON 9,954 (€2,000) for the violation of Article 14(1) and (2) GDPR. The controller had the obligation to communicate information on the processing (e.g. the identity of the controller, or the purpose(s) of processing) when first communicating with the data subjects. Finally, RON 24,886 (€5,000) for the violation of Article 15, meaning the controller had not given the data subjects the complete information they had requested when exercising their right of access. Both Articles 14 and 15 GDPR were analysed in relation to Article 12 GDPR, as it restates the obligation to provide the information in relation to the articles on data subject rights.
The DPA also ordered the controller in accordance with Article 58(2)(d) GDPR to provide its staff with regular training on how to respond to access requests and on how to lawfully process personal data.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
Sanction – cross-border processing The National Supervisory Authority for Personal Data Processing completed, in April 2025, an investigation at the operator Data Diggers Market Research SRL and found a violation of the provisions of art. 15 and art. 14 reported to art. 12 paragraph (1) and art. 6 paragraph (1) of Regulation (EU) 2016/679 (RGPD). As such, the operator was sanctioned with: a fine in the amount of 24,886 Lei, equivalent to the amount of 5,000 Euros, for violating the provisions of art. 15 of Regulation (EU) 2016/679, reported to art. 12 paragraph (1) of Regulation (EU) 2016/679; fine in the amount of 9,954.40 Lei, equivalent to 2,000 Euros, for violating the provisions of art. 14 of Regulation (EU) 2016/679, in relation to art. 12 paragraph (1) of Regulation (EU) 2016/679; fine in the amount of 24,886 Lei, equivalent to 5,000 Euros, for violating the provisions of art. 6 paragraph (1) of Regulation (EU) 2016/679. The investigation was initiated following notifications from two other EU data protection authorities, regarding complaints filed by two individuals from these countries against the operator Data Diggers Market Research SRL. Given that the operator Data Diggers Market Research SRL. has its main office in Romania, the National Supervisory Authority acted as the lead supervisory authority for the cross-border processing carried out by the controller Data Diggers Market Research SRL, in accordance with the provisions of art. 56 and art. 61 of the GDPR. During the investigation, it was found that the controller did not provide the petitioners with complete information following the exercise of the right of access to personal data, which constitutes a violation of the provisions of art. 15 of Regulation (EU) 2016/679, in relation to art. 12 paragraph (1) of the same regulatory act. At the same time, the controller did not provide at the time of the first communication with the petitioners the information that it was obliged to communicate to the data subjects, thus violating the provisions of art. 14 paragraphs (1) and (2) of Regulation (EU) 2016/679, in relation to art. 12 paragraph (1) of the same regulatory act. Also, the operator did not prove the fulfillment of one of the conditions regarding the lawfulness of the processing of the personal data of the petitioners, which represents a violation of the provisions of art. 6 paragraph (1) of Regulation (EU) 2016/679. At the same time, pursuant to art. 58 paragraph (2) letter d) of Regulation (EU) 2016/679, the National Supervisory Authority applied to the operator the corrective measure of ordering regular training measures for the company's staff regarding the procedure to be followed in order to correctly resolve the requests submitted by the data subjects and regarding compliance with the conditions of lawfulness of data processing, in relation to art. 6 of Regulation (EU) 2016/679.
