The National Supervisory Authority finalized in November current year an investigation at the controller Nobiotic Pharma SRL and found the breach of the provisions of Article 58 paragraph (1) of the General Data Protection Regulation.

Therefore, Nobiotic Pharma SRL was sanctioned with a fine in amount of Lei 9,890, the equivalent of EUR 2,000, for the breach of Article 58 paragraph (1) from the General Data Protection Regulation, concerning the controller’s obligation to provide the necessary information to the National Supervisory Authority.

In this context, we mention that Article 58 paragraph (1) letters a) and e) from the General Data Protection Regulation provides the following:

“(1) Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks.”.

The investigation was started following some complaints through which the claimant argued that the controller sent unsolicited commercial messages SMS type without having his/her consent.

Given that the controller did not respond to the request for information addressed by the National Supervisory Authority, it was sanctioned with fine.

Legal and Communication Department

A.N.S.P.D.C.P.