On June 1, 2026, the Romanian Data Protection Authority (DPA) concluded an investigation into a software development company. The DPA found that the company had failed to comply with its obligations concerning the right to erasure by deleting the data approximately 12 months after receiving the request, without providing the data subject with a final response regarding how the request had been handled and without justifying the delay. As a result, the DPA issued an administrative fine amounting to RON equivalent of EUR 11,000.
The investigation was initiated pursuant to the cooperation mechanism established under the GDPR, following a complaint submitted by a data subject to the French Data Protection Authority (CNIL). As the controller’s sole establishment is located in Romania and the processing was likely to substantially affect data subjects in more than one EU Member State, CNIL identified the DPA as the lead supervisory authority. The DPA accepted this designation and conducted the investigation in cooperation with the other supervisory authorities concerned in accordance with the GDPR’s cross-border enforcement framework.
The investigation further revealed that, with respect to other data subjects from various EU Member States and non-EU countries, the controller took up to 37 months to process erasure requests.
Following the investigation, the DPA informed the other supervisory authorities concerned, including CNIL, of the findings of the investigation in this cross-border case and the proposed measures.
In addition to the fine, the DPA imposed a series of corrective measures, requiring the controller to provide an appropriate response to the data subject, as well as to other affected data subjects in a similar situation, regarding requests for the erasure of personal data, and to implement regular staff training to ensure the proper, clear, transparent, and timely handling of requests by which data subjects exercise their rights, in accordance with the applicable legal deadlines.
The press release is available here (Romanian language only).
