The National Supervisory Authority finalized in May 2023 an investigation at the controller Global Baby Brands SRL and found the breach of the provisions of Article 7, by reference to the provisions of Article 4 point 11 from Regulation (EU) 2016/679, as well as of Article 21 from Regulation (EU) 2016/679.

Therefore, the controller was sanctioned:

with fine in amount of Lei 4,929.4 (the equivalent of EUR 1,000), for the breach of Article 7 from the GDPR, by reference to the provisions of Article 4 point 11 from Regulation (EU) 2016/679;
with reprimand for the breach of Article 21 from Regulation (EU) 2016/679.

The investigation was started following a complaint through which it was reported that the controller provided to the claimant several SMS commercial messages, without his/her consent.

Within the investigation, the National Supervisory Authority found that Global Baby Brands SRL did not present proofs from which to result that it processed the telephone number of the claimant, for the provision of the SMS text messages, with the freely, specific, informed and unambiguous given consent of the latter, thus breaching the provisions of Article 7 from Regulation (EU) 2016/679, by reference to the provisions of Article 4 point 11 from Regulation 2016/679.

Also, it was found that the controller breached the provisions of Article 21 from Regulation (EU) 2016/679, given that it provided to the claimant a commercial message for marketing purposes, after the exercise of the right to object by the latter.

At the same time, based on Article 58 paragraph (2) letter d) from Regulation (EU) 2016/679, it was ordered against the controller the corrective measure to ensure the compliance of the personal data processing operations with the observance of the conditions regarding the consent. In this respect, it was ordered:

to take the adequate measures in order to observe the GDPR provisions, so as to further process the personal data of the data subjects for direct marketing purposes that envisage the use of the electronic communication means (e-mail, telephone), by obtaining the specific and prior consent of the latter, inclusively by adopting some procedures in this respect and to correspondingly amend the information from the controller’s website; and
to amend the section “Privacy policy” from the controller’s website so as the data subjects to be provided with complete, correct, accurate and updated information on the processing of the personal data.

Also, it was recommended to the controller to take adequate measures for the observance of the data subjects’ rights, including the right to object and deletion of the claimant.

Legal and Communication Department

A.N.S.P.D.C.P