The National Supervisory Authority finalized an investigation at a natural personal and found there have been committed two offences by breaching the provisions of Article 5 paragraph (1) letters a) and b) and paragraph (2), corroborated with Article 6 paragraph (1), as well as the provisions of Article 14 paragraphs (1)-(4) of the General Data Protection Regulation.

Therefore, the natural person, as controller, was sanctioned with:

a fine, in amount of Lei 492,75 (the equivalent of EUR 100) for the breach of Article 5 paragraph (1) letters a) and b) and paragraph (2) of GDPR and of Article 6 paragraph (1) of GDPR;
a fine, in amount of Lei 492,75 (the equivalent of EUR 100) for the breach of Article 14 paragraphs (1)-(4) of GDPR.

The investigation was started following the receipt of multiple complaints.

Therefore, the complaint regarding the controller was about the fact that, by distributing some materials at the households from the village and by posting on the personal Facebook account, has disclosed personal data, on one hand, of a natural person by distributing photos of the payslip pertaining to the latter and, on the other hand, has disclosed personal date of the under aged son of another data subject, contained within a file from the Registry of evidence of the children registered with the Kindergarten from that village.

Following the investigation carried out, the National Supervisory Authority found that the controller did not present proofs from which it results that it has processed lawfully the personal data enclosed within the payslip of the data subject’s (first name, last name, personal identification number, workplace, position, salary), thus breaching the principles of the personal data processing provided under Article 5 paragraph (1) letters a) and b) and paragraph (2) of the GDPR and the provisions of Article 6 paragraph (1) of the GDPR.

At the same time, the controller did not present proofs from which it results that it has performed the information of the data subjects in relation to the processing of the personal data enclosed within the photographed file from the Registry of evidence of the children registered with the Kindergarten (first name and last name of the under aged son of the data subject), thus breaching the provisions of Article 14 paragraphs (1)-(4) of the GDPR.

Legal and Communication Department

ANSPDCP