Press Release

Sanctions applied

Within July-August 216, the National Supervisory Authority for Personal Data Processing carried out several ex officio investigations or based on the complaints received and applied the following sanctions.

Among them, we present the cases where sanctions have been applied with a minimum fine of 5000 lei.

1. ERB Retail Services

It was ascertain the following:

- The illegal processing of personal data provided by Article 32 of Law no. 677/2001 because ERB RETAIL SERVICES IFN S.A. reported negative data to Biroul de Credit S.A. without the prior information of certain natural persons, by nonobserving Articles 8 and 9 of ANSPDCP Decision no. 105/2007 and Article 12 (1) of Law no. 677/2001;

- The illegal processing of personal data provided by Article 32 of Law no. 677/2001 because ERB RETAIL SERVICES IFN S.A. reported, for several natural persons, several times in the same month negative data to Biroul de Credit S.A. for the same outstanding payments without observing the 30 days deadline from the due date, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007 and Article 4 (1) of Law no. 677/2001.

For these offences, sanctions of an amount of 25.000 lei were applied.

2. Veneto Banca Spa Italia Montebelluna

It was ascertain the following:

- The illegal processing of personal data provided by Article 32 of Law no. 677/2001 because Veneto Banca Spa Italia Montebelluna Bucharest Branch reported negative data to Biroul de Credit S.A. without the prior information of certain natural persons, by nonobserving Article 8 (2) of ANSPDCP Decision no. 105/2007 and Article 12 of Law no. 677/2001;

- The illegal processing of personal data provided by Article 32 of Law no. 677/2001 because Veneto Banca Spa Italia Montebelluna Bucharest Branch reported, for several natural persons, several times in the same month negative data to Biroul de Credit S.A. for the same outstanding payments without observing the 30 days deadline from the due date, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007 and Article 4 (1) of Law no. 677/2001.

For these offences, sanctions of an amount of 20.000 lei were applied.

3. CETELEM IFN SA

It was ascertain the following:

- “Refusal to Supply Information” contravention provided by Article 34 of Law no. 677/2001 because CETELEM IFN SA did not provide the information or documents requested by the supervisory authority in the exercise of his investigative powers set out by Article 27 of Law no. 677/2001;

- “The illegal processing of personal data” contravention provided by Article 32 of Law no. 677/2001 because CETELEM IFN SA reported, for several natural persons, negative data to Biroul de Credit S.A., with errors of data processing in the evidence system of the credit bureau which is contrary to the provisions of Article 4 (2) of ANSPDCP Decision no. 105/2007 and Article 4 of Law no. 677/2001.

For these offences, sanctions of an amount of 35.000 lei were applied.

4 . SC Vodafone Romania SA

It was ascertain the following:

- The non observance of the obligation provided by Article 3 (1) under the conditions provided by Article 3 (3) (b) of Law no. 506/2004, amended and completed, because Vodafone Romania SA did not take sufficient adequate technical and organizational measures in order to ensure the protection of the personal data of certain subscribers against the illegal access or dissemination.

For this offence, a fine of 10.000 lei was applied.

5. OMT Agency SRL

It was ascertain the following:

- The non observance of the provisions of Article 12 concerning the unsolicited communication, contravention provided by Article 13 (1) (q) of Law no. 506/2004 because SC OMT Agency SRL transmitted commercial communications by electronic mail to certain users for which it did not present the proof of obtaining their prior express consent, thus breaching the provisions of Article 12 (1) of Law no. 506/2004.

For this offence, a fine of 7.000 lei was applied.