The National Supervisory Authority finalized in March this year an investigation at a natural person, in capacity of controller, within which it found the breach of the provisions of Article 6 paragraph (1) in conjunction with Article 5 paragraph (1) letter a) of the General Data Protection Regulation.

Therefore, the controller was sanctioned with fine in amount of Lei 2,212.02 (the equivalent of Eur 450).

The investigation was started following an intimation through which it was claimed that the controller posted on a social network personal data of several natural persons.

During the performance of the investigation, the National Supervisory Authority found that the natural person disclosed personal data (first name, last name, city of domicile) of several data subjects through a social network, posting these data without their consent and without fulfilling any other condition provided under Article 6 paragraph (1) of the GDPR.

In this context, it was found that the controller had the obligation to observe the legality principle provided under Article 5 paragraph (1) letter a) of the GDPR.

Legal and Communication Department

A.N.S.P.D.C.P.