The National Supervisory Authority finalized in May current year an investigation at the controller Vodafone Romania SA and found the breach of the provisions of Article 15 paragraph (3) from the General Data Protection Regulation.

Therefore, the company Vodafone Romania SA was sanctioned with fine in amount of Lei 4,961, the equivalent of EUR 1,000.

The sanction was applied following a complaint through which it was reported that the controller breached the claimant’s right of access, by refusing to communicate him certain registrations of the conversations with the latter’s call centre.

During the performance of the investigation, the National Supervisory Authority found that the controller Vodafone Romania SA did not prove that it provided an answer to the claimant at his request for the exercise of the right of access within 30 days, thus breaching the provisions of Article 15 paragraph (3) from the GDPR.

In this context, we remind that Article 15 paragraph (3) provides that: “The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.”

Also, the corrective measure to adopt technical and organizational measures in order for the controller to ensure that it effectively handles the requests through which the rights of the data subjects provided under Regulation (EU) 679/2016 are exercised, including the right of access provided under Article 15, was applied.

Legal and Communication Department

A.N.S.P.D.C.P.