The National Supervisory Authority finalized in May 2022 an investigation at Interactions Marketing SRL and found the breach of the provisions of Article 32 paragraph (1) letter b) of the General Data Protection Regulation.

Interactions Marketing SRL, as processor of a controller, was sanctioned with fine in amount of Lei 4,942.3 (the equivalent of EUR 1,000).

The investigation was started following some complaints by a data subject that claimed that the controller provided by e-mail a commercial message to several persons thus disclosing their e-mail addresses.

Within the investigation performed it was found that Interactions Marketing SRL, as processor, performed a campaign for the controller complained, within which it sent a commercial message to the electronic post addresses belonging to a number of 27 persons, without hiding them, thus allowing the unauthorized disclosure of the e-mail addresses to the other recipients.

Therefore, Interactions Marketing SRL was sanctioned for the infringement of the provisions of Article 32 paragraph (1) letter b) of the General Data Protection Regulation, although, in capacity of processor, it had the obligation to take appropriate technical and organizational measures in order to ensure the confidentiality of the personal data processed.

Legal and Communication Department

ANSPDCP