The National Supervisory Authority for Personal Data Processing completed, in January 2026, an investigation into the data controller Altex România S.R.L., during which it found a violation of Article 58(1) of Regulation (EU) 2016/679.

The data controller was subject to four administrative fines amounting to a total of RON 40,768, equivalent to EUR 8,000, calculated based on the National Bank of Romania (BNR) exchange rate applicable on the date the sanction was imposed.

The investigation carried out at Altex România S.R.L. was initiated following the receipt of several complaints from data subjects concerning breaches of data protection legislation, specifically:

the failure of the data controller to respond to several requests to exercise the right of access and to one request for the rectification of personal data;
the failure of the data controller to provide a satisfactory resolution to a customer's request to close their account, as well as the failure to respond to a request to exercise the right to erasure of personal data.

During the investigation, it was established that the data controller had failed to comply with the requests addressed to it by the National Supervisory Authority for Personal Data Processing in the exercise of its investigative powers.

Accordingly, the data controller was fined for violating Article 83(5)(e), in conjunction with Article 58(1)(a) and (e), of Regulation (EU) 2016/679.

Legal and Communication Department

A.N.S.P.D.C.P