On 10 April 2024, the Bucharest Tribunal partially admitted the claim of an online retailer and reduced in half the initially applied fines.
The court decision comes after in June 2023 this retailer has been sanctioned by Romanian DPA with:
- EUR 30,000 for the failure to comply with the GDPR rules on data subjects’ erasure right (reduced by the tribunal to EUR 15,000);
- EUR 10,000 for the violation of the GDPR rules on consent (reduced by the tribunal to EUR 5,000).
The controller has also been sanctioned with a warning for violating the transparency obligations (since the data processing-related information on the website was not provided in full).
In the context of the aforesaid fines and warning, specific corrective measures were also applied.
The case is interesting because it was part of the cooperation mechanism under GDPR, as the Romanian DPA was notified by the Hungarian DPA of the complaints received from the Hungarian individuals. The Romanian DPA therefore acted in this case as a lead supervisory authority, considering that the retailer had its main establishment in Romania.
We have extensively covered on our blog this investigation and the sanctions applied in June 2023.
The text of the Bucharest Tribunal decision, with the motivation of the court, is not yet available. This decision is not final and may still be challenged before the Bucharest Court of Appeals.
