The National Supervisory Authority for Personal Data Protection applied contraventional fines of a total amount of 15.000 RON to a data controller, a natural person

The National Supervisory Authority for Personal Data Protection applied contraventional fines of a total amount of 15.000 RON to a data controller, a natural person.

The investigation’s minutes indicate the following contraventions:

1. “Failure to notify and malevolent notification”, more precisely the failure to submit the notification provide under Article 22 paragraph (1) and (3) and Article 29 paragraph (3) of Law no. 677/2001;

2. “Illegal processing of personal data”, whereas the data controller collected personal data through the website www.clientineseriosi.ro for the purpose of organising and putting at the disposal of third parties, including Internet users, data belonging to individuals considered to be bad-payers of various entities, without being able to prove that the collection of the personal data was made in good faith and in compliance with the principles of legitimacy of data processing, in the context of the collection and onward disclosure of the data on the Internet also by the third parties, without the express consent of the data subject and without the observance of their right to information according to Article 12 (2) of Law no. 677/2001;

3. “Failure to fulfill the obligations regarding the confidentiality and enforcement of security measures”, whereas the data controller did not prove the compliance with the security measure of the data processing carried out, according to Article 20 of Law no. 677/2001.

Thus, taking into account the findings, the following sanctions were applied:

     1. Fine of an amount of 5.000 lei, according to Article 31 of Law no. 677/2001, in conjunction with Articles 5 and 8 of Government Ordinance no. 2/2001.

     2. Fine of an amount of 8.000 lei, according to Article 32 of Law no. 677/2001, in conjunction with Articles 5 and 8 of Government Ordinance no. 2/2001.

     3. Fine of an amount of 2.000 lei, according to Article 33 of Law no. 677/2001, in conjunction with Articles 5 and 8 of Government Ordinance no. 2/2001.

Moreover, bearing in mind the negative specific risks towards the rights and liberties of a significant number of persons by disclosure of their personal data on www.clientineseriosi.ro, the National Supervisory Authority for Personal Data Processing, based on Article 21 (3) (d), related to Article 4 (1), Article 5 and Article 12 (2) of Law no. 677/2001, in conjunction with Article 3 (5) of Law no. 102/2005, ordered the cessation of the personal data processing carried out by the sanctioned controller through the website www.clientineseriosi.ro and the deletion of the personal data of the natural persons collected via this webpage.

For the public information, we underline that, in order to exercise the rights provided by Law no. 677/2001, a  natural person has the possibility to submit a written request, dated and signed, to the data controller (legal or natural person, from public or private sector), to which the latter one is obliged to answer within 15 days.

In the situation in which, after the fulfillment of the 15 days, no answer was received or the request was not solved, the data subject may submit a complaint to the supervisory authority. The complaint has to be accompanied by the proof of addressing first to the data controller. In this context, we mention that you can find the complaint form on our website, www.dataprotection.ro, section Complaints/Complaint Templates.

Legal and communication Department