The National Supervisory Authority finalized in September 2023 an investigation at the controller NN Asigurari de Viata SA and found the breach of the provisions of Article 21 paragraph (3) from Regulation (EU) 2016/679.

Therefore, the controller was sanctioned with fine in amount of Lei 4,946.50 (the equivalent of EUR 1,000).

The investigation was started following a complaint submitted by a data subject that reported that the controller NN Asigurari de Viata breached his/her right to object, by sending marketing messages through Linkedin messages.

Within the investigation it resulted that the controller did not observe the legal provisions regarding the processing of personal data given that it did not take into consideration the requests of the claimant, submitted by electronic post, through which he/she expressed his/her option to not be further contacted with direct marketing messages without his/her consent.

At the same time, within the investigation, based on Article 58 paragraph (2) letter d) from Regulation (EU) 2016/679, also the corrective measure to adopt some adequate and efficient internal procedures for the protection of the data regarding the manner of handling of the requests submitted by the data subjects based on Regulation (EU) 2016/679 was applied to the controller, with the observance in all cases of the applicable provisions on the analysis and handling without delay of these requests, so as the controller to ensure that it effectively handles the requests through which the rights of the data subjects are exercised, as well as the regular training of the controller’s personnel.

In this respect, we mention that Article 21 paragraph (3) from Regulation (EU) 2016/679 provides that:

“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

Legal and Communication Department

A.N.S.P.D.C.P.