After the Romanian DPA announced on 31 January 2024 that it fined one of Bucharest’s districts, the authority fined again the same district on 20 February 2024 for failing to respond to its requests.
This time, one of Bucharest’s districts was sanctioned for failing to implement the corrective measure ordered in December 2023 by the Romanian DPA.
The Romanian DPA opened an investigation following complaints about a possible violation of the legal provisions on data processing by this controller through an online platform used to collect personal data, which was purchased before the draft resolution was debated and approved by the Local Council.
During the investigation, the controller did not respond to the Romanian DPA’s repeated requests for information. In this regard, the controller was sanctioned with a warning, given its status as a public entity in relation to the provisions of Law No. 190/2018. At the same time, a corrective measure was ordered, consisting in providing/communicating all the requested information.
As the controller did not implement the previously ordered measures through an action plan within the deadline set by the Romanian DPA, the investigation continued.
The Romanian DPA imposed a EUR 2,000 fine since the controller failed to provide evidence of compliance with the action plan. We have written about this fine here.
At the same time, a corrective measure was ordered, consisting in providing/communicating all the requested information. The controller did not respond to the Romanian DPA’s request for information within 10 days from the date of sending the second report, namely until 28 December 2023.
As a result, the controller was sanctioned with a comminatory fine (i.e., a fine calculated per day of delay) of RON 159,000 (approx. EUR 31,800) by decision of the President of the Romanian DPA. The fine was calculated from 29 December 2023 to 19 February 2024 (53 days).
According to the law on functioning of the Romanian DPA, such authority may impose a comminatory fine of up to RON 3,000 (approx. EUR 600) for each day of delay, in case of non-compliance with the ordered measures or in case of tacit or explicit refusal to provide all the information and documents requested in the investigation procedure or in case of refusal to submit to the investigation.
This is the first time that the Romanian DPA publicly announces a comminatory fine being applied.
The press release is available here (only in Romanian)
