Data Controller Sector 1 of Bucharest Municipality was sanctioned on 20.02.2024 with a penalty in the amount of 159,000 lei, as it has failed to carry out the remedial measure ordered by the finding/sanctioning report issued by the National Supervisory Authority for Personal Data Processing (on 14.12.2023).

In this context we mention that on 30.06.2023 our institution has started an investigation at Sector 1 of Bucharest Municipality following complaints referring to a potential breach of legal provisions on data processing by this controller, through an on-line platform used for the collection of personal data, procured before the of Local Council’s debate and approval of the Draft Decision.

As Sector 1 of Bucharest Municipality did not submit to the National Supervisory Authority the requested information considering its investigation mandate, the data controller was sanctioned with a reprimand ordered by the finding/sanctioning report issued on 09.11.2023. The reprimand sanction was accompanied by a remedial plan to provide/communicate all the information requested by the Data Protection Authority within 10 days from the date of the communication of the report.

Afterwards, considering the data controller had not sent the requested information to the Authority, in line with Article 14 (5) (e) of Law no. 190/2018, the National Supervisory Authority for Personal Data Protection (ANSPDCP) had sanctioned Sector 1 of the Municipality of Bucharest with a fine in the amount of 10,000 lei, based on the finding/sanctioning report no. 25490 of 14.12.2023.

In the same report, the Authority also applied a reprimand, consisting of the obligation of the data controller to provide all information priorly requested, which were necessary to deal with the complaints received.

The data controller Sector 1 of the Municipality of Bucharest had once again failed to comply with the request for information from ANSPDCP within the 10-day deadline from the communication of the second report, respectively the 28.12.2023.

As a consequence, on 20.02.2024 the data controller was sanctioned with a (provisional) penalty for non-compliance in the amount of 159,000 lei, by decision of the President of the National Supervisory Authority for Personal Data Protection. The (provisional) penalty for non-compliance was calculated from 29.12.2023 to 19.02.2024 (53 days).

We note that, according to Article 18 (2) of Law no. 102/2005 on the establishment, organisation and functioning of the National Supervisory Authority for Personal Data Processing, republished, the ANSPDCP may order, by decision, the application of a (provisional) penalty for non-compliance of up to 3,000 lei for each day of delay, calculated from the date established by the decision, in case of failure to comply with the measures ordered or in case of tacit or express refusal to provide all information and documents requested in the investigation procedure or in case of refusal to submit to the investigation.