The National Supervisory Authority for Personal Data Processing completed, in October 2024, an investigation at the controller Blackcab Systems SRL and found the infringement of Article 12 paragraph (3) and of Article 15 paragraphs (1) and (3) by reference to the provisions of Article 83 paragraph (5) letter b) of Regulation (EU) 2016/679.

As such, the controller was sanctioned with a fine of 4,975.9 lei (the equivalent of 1,000 euros).

The investigation was started as a result of a complaint submitted by a natural person who reported a possible violation of Regulation (EU) 2016/679.

The data subject, a customer of the controller, addressed to it with a request regarding the right of access and requested a copy of his personal data.

During the investigation, it was found that the controller Blackcab Systems SRL did not prove that it responded to the petitioner’s request, thus infringing the provisions of Article 12 paragraph (3) and of Article 15 paragraphs (1) and (3) of Regulation (EU) 2016/679.

Also, pursuant to Article 58 paragraph (2) letter c) of Regulation (EU) 2016/679, the corrective measure consisting in taking the necessary measures to respect the rights of the data subjects provided by the Regulation and the communication of a response to the request of the data subject, through which he exercised his right of access, including the transmission of a copy of his data, according to Article 15 paragraphs (1) and (3) of Regulation (EU) 2016/679.

Legal and Communication Department

A.N.S.P.D.C.P