The National Supervisory Authority for Personal Data Processing completed, in May 2025, an investigation at the controller SC Kashto Concept SRL and found the breach of Article 4 paragraph (5) letter b) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

As such, the controller was sanctioned with a fine in the amount of 5,000 lei.

The investigation was initiated following a complaint received from a data subject alleging a possible violation of the provisions of Regulation (EU) 2016/679 by an online store.

As a result, the National Supervisory Authority for Personal Data Processing launched an investigation and found that, on the website owned by the controller, cookies were stored that were not technically necessary for the operation of the website.

At the same time, during the investigation, the controller did not prove that the user’s consent had been obtained.

We mention that the controller paid the imposed fine.

Legal and Communication Department

A.N.S.P.D.C.P