The Romanian National Supervisory Authority issues a fine against Royal President S.R.L

18 November 2019

The National Supervisory Authority has finalized, on the 18th of November 2019, an investigation with the controller Royal President S.R.L., ascertaining the following:
the infringement of the provisions of Article 12 paragraphs (3) and (4) and of Article 15 of the General Data Protection Regulation;
the infringement of Article 5 paragraph (1) letter f) and Article 32 paragraph (1) of Regulation (EU) 2016/679.

The controller Royal President S.R.L. was sanctioned with a reprimand for violation of the provisions of Article 15 and Article 12 paragraphs (3) and (4) of Regulation (EU) 2016/679 and with a fine in the amount of 11,932.25 lei, the equivalent of 2500 Euros for infringing Article 5 paragraph (1) letter f) and Article 32 paragraph (1) letter b) of Regulation (EU) 2016/679.
The sanctions were applied following a complaint alleging that Royal President S.R.L. refused to handle a request for exercising the right of access provided by Article 15 of the General Data Protection Regulation, as well as the fact that it disclosed personal data without the consent of the data subject.
During the investigation, the controller Royal President S.R.L. could not prove the handling of the request for the exercise of the right of access within the time limit provided by Article 12 paragraph (3) of Regulation (EU) 2016/679.
It was also found that the personal data collected through the accommodation form were not processed in a way that would ensure their security, by taking appropriate technical or organisational measures, in order to prevent any unauthorised disclosure thus infringing the provisions of Article 5 paragraph (1) letter f), of Article 32 paragraph (1) letter b) and of Article 32 paragraph (2) of Regulation (EU) 2016/679.
At the same time, a corrective measure was applied to the controller, which consisted in the elaboration and implementation of an internal procedure regarding the protection of personal data of the beneficiaries of the accommodation services, by reference to the provisions of Article 32 of Regulation (EU) 2016/679.

To read the press release in Romanian, click here

For further information, please contact the Romanian Supervisory Authority: anspdcp@dataprotection.ro

The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.