The National Supervisory Authority for Personal Data Processing finalized in December 2023 an investigation at the controller District 1 of the Bucharest Municipality and found the breach of the provisions of Article 58 paragraph (1) letters a) and e) from the Regulation (EU) 2016/679 and of Article 14 paragraph (5) letter e) from Law no. 190/2018.

Therefore, the controller was sanctioned with fine in amount of Lei 10,000.

The investigation was started following some intimations through which a possible breach of the provisions of Regulation (EU) 2016/679 was reported.

Therefore, the controller District 1 of Bucharest Municipality, through decisions of the Local Council, established the manner under which the residents of District 1 can submit the necessary documents in order to benefit from financial incentives of the program “Local measures intended to ensure the energetic needs and for the efficiency of the energy consumption within the District 1 households”, respectively in physical form or on an e-mail address, created strictly for the implementation of the program. However, District 1 of the Bucharest Municipality made available for the beneficiaries an online platform, https://ticheteanticriza.primarias1.ro , for the collection of the data, procured before the draft decision to be debated and approved within the Local Council.

Within the investigation performed, the controller did not respond to the repeated requests for information provided by the National Supervisory Authority for Personal Data Processing.

Therefore, given that the controller did not provide the information requested by our institution, considering the capacity of public institution of the controller by reference to the provisions of Law no. 190/2018, it was sanctioned with reprimand. At the same time, the application of a remedy measure consisting of the provision/communication of all requested information was ordered.

Given that the controller District 1 of Bucharest Municipality did not fulfill the measure previously ordered through the remedy plan, within the deadline established by the authority, the investigation continued.

Considering that the controller did not prove the execution of the remedy measure ordered, the National Supervisory Authority for Personal Data Processing sanctioned District 1 of Bucharest Municipality with fine for the breach of the provisions of Article 58 paragraph (1) letters a) and e) from Regulation (EU) 2016/679. And of Article 14 paragraph (5) letter e) from Kaw no. 190/2018.

At the same time, within the investigation, in accordance with the provisions of Article 58 paragraph (2) letter d) from Regulation (EU) 2016/679, the National Supervisory Authority for Personal Data Processing applied to the controller the corrective measure to provide/communicate all requested information, necessary for the handling of the aspects reported.

Legal and Communication Department

A.N.S.P.D.C.P.