On 5 April 2024, the Cluj Tribunal delivered its ruling in a case concerning a challenge against a GDPR sanction issued by the Romanian DPA. In short, the Cluj Tribunal upholds in part the application against the Romanian DPA (defendant) and replaces the penalty of a fine imposed on the applicant with a warning. It dismisses the remainder of the application as unfounded.
The background of this case: On 8 February 2023, the Romanian DPA announced it sanctioned a provider of a recruitment services platform in the medical sector with a EUR 5,000 fine for failing to implement adequate technical and organizational measures to ensure a level of security appropriate to the processing risk. The investigation was launched following the receipt of a data breach notification submitted by the said controller, and it was finalized in January 2023 (see our complete summary here). The applicant`s complaint against the minute of the Romanian DPA was registered at the Cluj Tribunal on 22 February 2023.
The ruling of Cluj Tribunal is not final.
Following this solution, we are now awaiting the grounds for which the Tribunal ruled as such. According to the Romanian procedural rules, the reasoning should be drafted within 30 days of the ruling. However, this term is not always rigorously respected in practice.
