Sanctions applied – November

In November 2016, the National Supervisory Authority for Personal Data Processing carried out several ex officio investigations or based on the complaints received and applied the following sanctions.

Among them, we present the cases where sanctions have been applied with a minimum fine of 5000 lei.

1. ERB Retail Services IFN S.A.

In several cases it was ascertain the following:

The illegal processing of personal data, provided by Article 32 of Law no. 677/2001, by infringing Articles 12 and 14 of Law no. 677/2001, whereas ERB RETAIL SERVICES IFN S.A. did not handle the requests of the data subjects (6 petitioners) exercising the right of intervention, namely to adopt measure for the deletion of the negative data transmitted to Biroul de Credit, without their prior information, as provided by Article 8 paragraph (2) of ANSPDCP Decision no. 105/2007.

For these offences, sanctions of an amount of 42.000 lei were applied.

2.  S.C. Hello Holidays S.R.L.

S.C. Hello Holidays S.R.L. was sanctioned based on Article 13 of Law no. 506/2004 for the nonobservance of Article 12 of the same law concerning unsolicited communications, because it had transmitted, repeatedly, commercial communication to an email address by using electronic communications (electronic mail), without obtaining the prior expressed consent of the data subject for received such communication.

For this offence, a sanction of an amount of 5.000 lei was applied.

3. Alpha Bank S.A.

It was ascertain the following:

1. Illegal processing of personal data, provided by Article 32 of Law no. 677/2001, whereas Alpha Bank S.A. reported negative data to Biroul de Credit without proving the prior notification of the data subjects, by infringing the provisions of Article 8 (2) of ANSPDCP Decision no. 105/2007, of Article 9 (1) of ANSPDCP Decision no. 105/2007 and of Article 12 (1) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

2. Illegal processing of personal data, provided by Article 32 of Law no. 677/2001, whereas Alpha Bank S.A. reported negative data to Biroul de Credit before the deadline for 30 days from the due date expired, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007, by infringing Article 4 (1) letters a) and c) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

For these offences, a sanction of an amount of 9.000 lei was applied.

4. BCR Banca pentru Locuințe S.A.

It was ascertain the following:

1. Illegal processing of personal data, provided by Article 32 of Law no. 677/2001, whereas BCR Banca pentru Locuințe S.A. reported negative data to Biroul de Credit without proving the prior notification of the data subjects and for the negative date reports concerning the due payment obligations not transmitted it carried out the prior information of the data subjects, as provided by Article 8 (2) of ANSPDCP Decision no. 105/2007, but without providing, at the data of the prior information, also the information provided by Article 9 (1), by infringing Article 8 (2) of ANSPDCP Decision no. 105/2007, Article 9 (1) of ANSPDCP Decision no. 105/2007 and Article 12 (1) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

2. Illegal processing of personal data, provided by Article 32 of Law no. 677/2001, whereas BCR Banca pentru Locuințe S.A. reported negative data to Biroul de Credit before the deadline for 30 days from the due date expired, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007, by infringing Article 4 (1) letters a) and c) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

For these offences, a sanction of an amount of 15.000 lei was applied.