A recent data protection-related court case involving a Romanian data controller challenging GDPR-related sanctions and corrective measures resulted in a partially favorable outcome for the company. While the court upheld the fine imposed for the GDPR infringements, it annulled the corrective measure requiring the erasure or destruction of personal data used as a means of identification.
As background, the Romanian Data Protection Authority (DPA) fined the controller the RON equivalent of EUR 20,000 for failure to properly handle requests for the deletion of personal data. The investigation further revealed that the controller collected and stored excessive amounts of personal data, including scanned copies of certain documents, even though the personal data was no longer necessary for the purpose of identification in connection with the conclusion of a subscription contract, leading to an additional administrative fine amounting to the RON equivalent of EUR 20,000.
Moreover, the company was also required to take specific corrective actions. These included providing a complete response to the data subject’s request to delete their personal data, adopting the necessary technical and organizational measures, including providing appropriate GDPR training to designated personnel and removing from its database the personal data and identification documents of the affected individual that had been collected during the unsuccessful subscription process for the services offered.
Additionally, the DPA required the company to clearly establish the legal basis for the collection of personal data in relation to each purpose of processing, as part of the steps leading up to the conclusion of a subscription contract for its services, so that personal data and identity documents are not collected and subsequently stored in an excessive or unlawful manner, except in compliance with applicable law while ensuring that data subjects are provided with clear, transparent, and accessible information.
The ruling of the Bucharest Court of Appeal is final.
The court’s detailed reasoning for its decision is not yet available.
