On March 16, 2026, the Bucharest Tribunal dismissed a complaint from a company in the oil and gas sector. The company had been fined by the Romanian Data Protection Authority (DPA) and was contesting the fine.
As background, the DPA fined the controller the RON equivalent of EUR 110,000 for the unlawful disclosure of customer data collected from ID cards and pay stubs, following repeated unauthorized access to its systems and the use of such data to obtain loans from non-bank financial institutions in the customers’ name. Additionally, the DPA found that no measures had been taken to ensure that any natural person acting under the authority of the controller and having access to personal data processes such data only on the controller’s instructions, nor had the controller implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed by the processing.
The court’s detailed reasoning is not yet available. It is also worth noting that the decision may still be challenged before the Bucharest Court of Appeal.
