The National Supervisory Authority completed on the 10th of April 2020 an investigation at controller Estee Lauder Romania SRL and found that it violated the provisions of Article 6, Article 7 and Article 9 of the General Data Protection Regulation.

The controller Estee Lauder Romania SRL was sanctioned with a fine in the amount of 14,483.4 lei, the equivalent of 3,000 euros.

The sanction was applied to the controller following a complaint alleging the illegal data processing by disclosing, respectively collecting personal data (name, surname, telephone number, date of birth and healh information), without the consent or another legal ground.

At the same time, the corrective measure was imposed to ensure the compliance of the operations of collection and further procesing of personal data with the General Data Protection Regulation, by regularly training its own staff on the importance of complying with the rules of processing the personal data of its employees for each situation of data processing, in order to avoid their illegal disclosure, in line with Article 58 paragraph (2) letter d) of the GDPR.

A.N.S.P.D.C.P.