The National Supervisory Authority for Personal Data Processing completed, in February 2025, an investigation at the controller Bucharest Down Town Hotel SRL and found the breach of Article 12 paragraph (3), Article 13 and Article 15 of Regulation (EU) 2016/679.

As such, the controller was sanctioned with fine of 4,975.00 lei (the equivalent of 1,000 euros).

The investigation was initiated following a complaint alleging a violation of the provisions of Regulation (EU) 2016/679.

The National Supervisory Authority for the Processing of Personal Data found that the data subject requested to be provided with all personal data belonging to him and held by the controller, including a copy of the signed document and any audio-video recording concerning him.

During the investigation, it emerged that the controller had not provided proof that it had sent a response within the legal deadline to the request for the exercise of the right of access of the data subject.

It was also found that the controller had sent the response to the petitioner, as a result of the steps taken by the National Supervisory Authority for the Processing of Personal Data, without providing him with all the personal data he holds, including a copy of the signed document and any audio-video recording relating to him. Therefore, this situation constitutes a violation of the provisions of Article 12 paragraph (3), Article 13 and Article 15 of Regulation (EU) 2016/679.

Pursuant to Article 58 paragraph (2) letter c) of Regulation (EU) 2016/679, the following corrective measures were ordered to the controller:

To comply, in all cases, with the applicable provisions regarding the analysis and handling, without delay, of requests to exercise the rights provided for in Regulation (EU) 679/2016 and to communicate the responses to the data subjects within the legal deadlines;
To provide full information to all data subjects, in relation to all activities involving the processing of personal data, by providing all the information provided for in Article 12 and Article 13 of Regulation (EU) 2016/679.

Legal and Communication Department

A.N.S.P.D.C.P