The National Supervisory Authority for Personal Data Processing completed, in January 2026, an investigation into the data controller the Alliance for the Union of Romanians (AUR) political party and found a violation of Article 12(3) and (4), in conjunction with Articles 15, 17 and 21 of Regulation (EU) 2016/679.

Accordingly, the data controller was sanctioned with an administrative fine in the amount of RON 5,089 (the equivalent of EUR 1,000).

The investigation was initiated following a complaint lodged by a natural person.

In the course of the investigation, it was established that the controller had failed to provide a response to the data subject’s request, by which the data subject had exercised their rights of access, erasure and objection, following receipt of a personalised letter containing electoral content as part of the 2025 presidential election campaign.

In addition, the following corrective measures were imposed on the controller:

to provide the data subject with a written response to their request, in accordance with Articles 15, 17 and 21 of Regulation (EU) 2016/679;
ensure that its personal data processing operations comply with Regulation (EU) 2016/679 by implementing the necessary technical and organisational measures, including ensuring appropriate training for the personnel designated for this purpose, so as to ensure that the controller properly assesses and duly handles all requests through which data subjects exercise their rights and provides a response within the applicable time limits and in accordance with the requirements set out in Articles 12 to 22 of Regulation (EU) 2016/679.

Legal and Communication Department

A.N.S.P.D.C.P