The National Supervisory Authority finalised in June 2022 an investigation at the controller Wabag Water Services SRL and found the breach of the provisions of Article 5 paragraph (1) letter a) and paragraph (2) and of Article 6 of the General Data Protection Regulation.

The controller Wabag Water Services SRL was sanctioned with fine in amount of Lei 4,945.40 (the equivalent of EUR 1,000).

The investigation was started following the receipt of some complaints from a claimant that argued that the personal data were used by her own employer (Wabag Water Services SRL), without her consent, for the purpose of registration and scheduling on the national vaccination platform for the vaccination against Covid-19.

Within the investigation it was found that the controller Wabag Water Servcies SRL used the personal data of the claimant (employee of the controller) for the purpose of registration and scheduling her on the national vaccination platform for the vaccination against Covid-19, during 2021, without proving the existence of the claimant’s consent and without the existence of another case in which the consent was not necessary, thus breaching the provisions of Article 5 paragraph (1) letter a) and of paragraph (2) and of Article 6 of the Regulation (EU) 2016/679.

In this context, we underline that Article 5 of Regulation (EU) 2016/679 establishes a series of principles that need to be observed within the data processing. Among these is the one regarding the processing of data lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”), this being provided under Article 5 paragraph (1) letter a) of the Regulation.

Also, Article 15 paragraph (2) of Regulation (EU) 2016/679 provides that the controller is responsible for the compliance with the processing principles and shall be able to prove this compliance (accountability principle).

Legal and Communication Department

A.N.S.P.D.C.P.