The National Supervisory Authority for Personal Data Processing completed, in June 2025, an investigation at the controller YDAIL CONSTRUCT SRL and found the breach of Article 4 paragraphs (5) letter a) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

As such, the controller was sanctioned with a fine of 20,000 lei.

The investigation was initiated following a complaint received from a data subject alleging a possible violation of the provisions of Regulation (EU) 2016/679 by an online store.

During the investigation, the National Supervisory Authority for Personal Data Processing found that, on the website owned by the controller, cookies were stored that were not technically necessary for the operation of the website, without the existence of consent.

At the same time, pursuant to the provisions of Article 58 paragraph (2) letter d) of Regulation (EU) 2016/679, the corrective measure to reconfigure the way in which cookies are installed on users’ devices through the action of accessing the controller’s website, so that cookies that are not technically necessary (e.g. marketing, statistics) are installed exclusively after the user has expressed consent was ordered.

Legal and Communication Department

A.N.S.P.D.C.P