The National Supervisory Authority for Personal Data Processing completed, in April 2025, an investigation at the controller ROUMASPORT SRL and found the breach of Article 5 paragraph (1) letters a) and b) and Article 6 paragraph (1) of Regulation (EU) 2016/679, in conjunction with Article 5 of Law no. 190/2018.

As such, the controller was sanctioned with a fine in the amount of 24,887 lei (the equivalent of 5,000 euros).

The investigation was initiated following complaints that reported possible violations of personal data processing.

The investigation revealed that the controller accessed the existing video surveillance system at one of its workplaces and illegally processed the images of its employees, including for the purpose of their disciplinary investigation, thus violating the principles of processing and the conditions of legality of processing.

At the same time, the controller was ordered to take corrective measure to ensure the compliance of personal data processing operations in the video monitoring activity, especially in the case of disciplinary investigations of employees, in compliance with the principles and conditions of data processing.

Legal and Communication Department

A.N.S.P.D.C.P