The National Supervisory Authority for Personal Data Processing completed, in May 2025, an investigation at the controller SC Diamir SRL and found the breach of Article 58 paragraph (1) letters a) and e) and Article 6 paragraph (1) of Regulation (EU) 2016/679.

As such, the controller was sanctioned with a reprimand and a fine of 5,084.80 (equivalent to 1,000 euros).

The investigation was initiated following a complaint alleging that the controller displayed a person’s identity card at the workplace, thus revealing the name, surname, address, series and number of the identity card and the photograph of the person concerned.

During the investigation, the National Supervisory Authority for Personal Data Processing found that the controller did not communicate to our institution the information requested based on the legal powers of investigation, thus violating the provisions of Article 58 paragraph (1) letters a) and e) of Regulation (EU) 2016/679. For this deed, the controller was sanctioned with a reprimand.

Our institution also noted that the controller violated the provisions of Article 6 paragraph (1) of Regulation (EU) 2016/679 as it disclosed the personal data of a natural person without his/her consent and without proving the existence of another legal basis for the processing.

Legal and Communication Department

A.N.S.P.D.C.P