On 8 September 2026, the Romanian DPA concluded an investigation into a company operating in the retail sector. According to the DPA, the controller committed infringements concerning the right to object to direct marketing. As a result, the DPA issued an administrative fine amounting to RON equivalent of EUR 2,000.
The investigation commenced following a complaint from a data subject who reported continuing to receive unsolicited marketing calls and SMS messages after opting out of such communications. Further to the investigation, the Romanian DPA concluded that the controller had failed to give effect to the data subject’s right to object and had unlawfully continued to process their personal data for direct marketing purposes.
In addition to the fine, the DPA ordered the company to implement appropriate technical and organizational measures to ensure that personal data is processed for marketing purposes in compliance with the GDPR and that both the controller and its processors effectively respect data subjects’ rights.
The press release is available here (Romanian only).
