The National Supervisory Authority finalised in July 2022 an investigation at the controller Sephora Cosmetics Romania S.A. and found the breach of the provisions of Article 21 of the General Data Protection Regulation.

The controller Sephora Cosmetics Romania SA was sanctioned with fine in amount of Lei 9.883,60 (the equivalent of the sum of EUR 2,000).

The investigation was started following the receipt of a complaint from a complainant that was claiming that she received SMS type commercial messages from Sephora Cosmetics Romania S.A on her telephone number. Also, she claimed that following her repeated requests submitted at the end of 2020 for her data not to be used for marketing purpose, Sephora informed her at the beginning of 2021 that her data will no longer be processed for marketing purposes. However, subsequently, during 2021, the claimant received unsolicited SMS type marketing messages from Sephora Cosmetics S.A..

Within the investigation performed it was found that Sephora Cosmetics Romania S.A. has provided commercial messages for marketing purposes to the claimant, on her telephone number, several times, during 2021, , although through the requests submitted to the controller during 2020, she exercised her right to object in relation to the use of her own telephone number for marketing purposes.

Therefore, Sephora Cosmetics Romania SA was sanctioned for the breach of the provisions of Article 21 of the General Data Protection Regulation that guarantees to the data subject the right to object at any moment, for reasons related to his/her particular situation, to the processing of the personal data concerning him/her.

Legal and Communication Department

A.N.S.P.D.C.P.