Court partially overturns GDPR sanctions applied in the context of GPS monitoring

A recent court case involving a Romanian data controller and the Romanian Data Protection Authority (Romanian DPA) has concluded with a partial success for the company. While the fine imposed for GDPR violations was annulled in court, the reprimand related to excessive data retention remains in effect.

 Background of the investigation

The investigation, completed in October 2024, was initiated following a complaint about the controller’s handling of employee data. The Romanian DPA found that the company had:

• Monitored employees’ GPS locations outside of working hours, including vacation periods, without a valid legal basis.
• Stored GPS tracking data beyond the permitted 30-day retention period, in violation of GDPR and Romanian data protection laws.

As a result, the controller was sanctioned with:

1. A fine of 19,898.4 RON (the equivalent in RON of 4,000 EUR) for unlawful processing of GPS-tracked data.
2. A reprimand for excessive retention of employee data.

We have previously written on our blog about this imposed GDPR fine (the text is available here).

 Court decision

After contesting the sanctions, on June 5, 2025, the Bucharest Tribunal ruled that:

• The fine imposed for processing GPS data beyond work hours was annulled.
• The warning regarding excessive data storage beyond 30 days was upheld, reinforcing the company’s obligation to comply with storage limitation principles under GDPR.

 Implications for data protection compliance

We are still waiting for the text of the court’s decision to understand the reasoning behind its judgment. In the meantime, it may be stressed out that, while the controller successfully challenged the fine, the court’s decision highlights that excessive retention of personal data remains a compliance risk. Companies utilizing employee tracking systems must ensure data collection and storage policies align with GDPR principles and national legal provisions, particularly those related to data minimization and retention periods.

The court decision can be challenged before the Court of Appeals.