The National Supervisory Authority for Personal Data Processing, completed, in August 2025, an investigation at the controller Lenjeria Magică SRL and found a violation of the provisions of Article 4 paragraph (5) letters a) and b) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

As such, the controller was sanctioned with a fine of 15,000 lei.

The investigation was initiated following a complaint alleging a possible violation of the provisions of Regulation (EU) 2016/679 and Law no. 506/2004.

During the investigation, the National Supervisory Authority for Personal Data Processing found that, starting with 15.04.2025, cookies that were not technically necessary on the user’s equipment were stored on the website owned by the controller, without clear information about their existence and without the explicit consent of the data subjects.

In this context, the controller was fined for violating the provisions of Article 4 paragraph (5) letters a) and b) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, pursuant to Article 13 paragraph (1) letter i) and paragraph (2) of the same legal act, which provides:

“Article 13 (1) The following acts constitute contraventions: (…) i) failure to comply with the conditions provided for in Article 4 paragraph (5) (…).

(2) The contraventions provided for in paragraph (1) letters a)-l), n), o) and q) are sanctioned with a fine of 5,000 lei to 100,000 lei, and for commercial companies with a turnover of over 5,000,000 lei, by derogation from the provisions of Government Ordinance no. 2/2001 on the legal regime of contraventions, approved with amendments and completions by Law no. 180/2002, with subsequent amendments and completions, with a fine in the amount of up to 2% of the turnover.”

Legal and Communication Department

A.N.S.P.D.C.P