ICCJ - 681/2025
| ICCJ - 681/2025 | |
|---|---|
 | |
| Court: | ICCJ (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 5(1)(a) GDPR Article 82 GDPR Article 85 GDPR |
| Decided: | |
| Published: | |
| Parties: | |
| National Case Number/Name: | 681/2025 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Romanian |
| Original Source: | ICCJ (in Romanian) |
| Initial Contributor: | RP |
A court imposed a €4,000 fine on a prosecutor in accordance with Article 82 GDPR for unlawfully disclosing personal data to the media without prior anonymisation.
English Summary
Facts
The High Court of Cassation and Justice (Înalta Curte de Casaţie şi Justiţie – ICCJ, Romania) decided a case concerning the unlawful disclosure of personal data by a prosecutor to the media.
A data subject brought a civil action against a prosecutor who had communicated an indictment to journalists without anonymising the data subject’s name or personal details. As a result, several media outlets published the information, which damaged the data subject’s honour and professional reputation.
The data subject requested non-material damages of €100,000. The Alba Tribunal (Tribunalul Alba) found that the prosecutor was personally liable and awarded €8,000 in damages. The Alba Iulia Court of Appeal (Curtea de Apel Alba Iulia) upheld the finding of liability but reduced the compensation to €4,000.
The prosecutor appealed to the High Court. They argued that only the institution (as data controller) could be responsible under data protection law, that the disclosure served the public interest, and that journalists were responsible for the subsequent publication. They also invoked exceptions under Law No. 190/2018 (implementing Article 85 GDPR) regarding processing for journalistic purposes.
The data subject replied that the prosecutor had breached their legal duty to protect personal data under the GDPR, Law No. 190/2018, Law No. 363/2018, and professional obligations laid down by Decision No. 197/2019 of the Superior Council of Magistracy (Consiliul Superior al Magistraturii – CSM).
Holding
The High Court dismissed the prosecutor’s appeal and upheld the finding of civil liability. It held that the prosecutor had personally committed an unlawful act by transmitting the indictment to the media without anonymising the data subject’s information.
The Court found that this act breached both data protection legislation and professional conduct rules applicable to magistrates. It rejected the prosecutor’s argument that the exemption for journalistic purposes in Law No. 190/2018 (implementing Article 85 GDPR) applied, as a prosecutor is not a journalist and must respect confidentiality obligations.
The Court also rejected the claim that responsibility lay with the journalists, noting that the prosecutor’s disclosure was the original cause of the unlawful processing. The Court noted that the prosecutor’s was personally liable under Article 82 of the GDPR as his conduct constituted an independent breach of GDPR obligations applicable to persons empowered by the controller, since the disclosure was made outside official instructions and without legal justification.
Finally, the Court considered that the unlawful disclosure caused non-material damage to the data subject’s dignity, image, and reputation. It confirmed that such harm does not need to be proven separately because moral damage is presumed when unlawful publication of personal data affects a person’s private and professional life.
Consequently, the High Court confirmed the €4,000 award.
Comment
The court did not directly refer to Article 5 but merely stated that the act was unlawful under the GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
