Home » Hotarari_definitive_de_mentinere_a_sanctiunilor_aplicate_de_Autoritatea_de_supraveghere
 Română | English | Francais

Final decisions on the maintenance of sanctions applied by the Supervisory Authority

 

Given that, through final judgments delivered in 2018, the courts largely maintained the contravention sanctions applied by the Supervisory Authority following the investigations carried out until the 25th of May 2018, we present the most relevant situations:

     1. SC ECO Private Services SRL

The following facts were found:

  • “The omission to notify and the notification in bad faith”, provided by Article 31 of Law no. 677/2001, by infringing the provisions of Article 22 of Law no. 677/2001 due to the fact that ECO PRIVATE SERVICES SRL has not provided evidence of notifying the processing of personal data that directly or indirectly allows the geographical location of individuals, although is using geo-location systems installed on motor vehicles since 2017.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing Article 12 (1) of Law no. 677/2001 due to the fact that ECO PRIVATE SERVICES SRL has provided any proof under any form provided by the law to inform the data subjects with the indications provided by Article 12 of the Law no. 677/2001 for any of the purposes for which it processes personal data.
  • “Failure to meet the obligations regarding the confidentiality and the implementation of the security measures” provided by Article 33 of the Law no. 677/2001, by failing to fulfill the obligations regarding the implementation of the security measures and ensuring the confidentiality of the processing provided by Article 19 and Article 20 of Law no. 677/2001 because ECO PRIVATE SERVICES SRL did not elaborate and implement a security policy that includes the minimum security requirements for the data processing it performs.
  • “Failure to comply with the conditions provided in Article 4 (5) of Law no. 506/2004, modified and completed”, since, on the website www.ecoprivateservices.ro, for the information stored in the terminal equipment of the user, ECO PRIVATE SERVICES SRL has cumulatively failed to fulfill the conditions provided by Article 4 (5) a) and b) of Law no. 506/2004, respectively obtaining the user’s consent for the existing cookies on the website www.ecoprivateservices.ro and providing the information before the consent for the general purpose of processing, the retention information, the lifetime, what information is stored and accessed as well as allowing the retention and/or access of third parties to the information stored in the user’s terminal equipment is expressed, contravention provided by Article 13 (1) i) of Law no. 506/2004, amended and completed.

For these facts, fines were imposed in total amount of 9.000 lei, maintained by final decision by the court.

    2. Verida Credit IFN SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 due to the fact that Verida Credit IFN SA transmitted negative data to Biroul de Credit before the 30-days deadline from the due date expired, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007, in violation of Article 4 (1) a) and c) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 because Verida Credit IFN SA did not provide evidence of the prior notification of data subject which is contrary to the provisions of Article 8 (2) of ANSPDCP Decision no. 105/2007, Article 9 (1) of ANSPDCP Decision no. 105/2007 and Article 12 of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

For these facts, fines were imposed in total amount of 17.000 lei, maintained by final decision by the court.

     3. SC BANCPOST SA

The following facts were found:

  • “Illegal processing of personal data”, contravention provided by Article 32 of Law no. 677/2001 due to the fact that SC BANCPOST SA transmitted negative data to Biroul de Credit related to 7 cases analysed in the report of the investigation and it was found that for a part of the cases it did not accomplished the prior information of the clients, even though it registered their negative data in the evidence system of Biroul de Credit, by infringing the provisions of Article 4 (1) a) and c), Article 12 of Law no. 677/2001, corroborated with Article 5 (1), Article 8 (2) and Article 9 (1) of ANSPDCP Decision no. 105/2007.

For these facts, fines were imposed in total amount of 20.000 lei, maintained by final decision by the court.

      4. SC Banca Românească SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 in the form of non-observance of the rights of intervention and information, rights provided by Article 14 (1) and Article 12 (1), in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with the provisions of Articles 8 and 9 of Decision 105/2007, since the applicant – Banca Românească SA – Member of the National Bank of Greece Group did not comply with the requests of the data subjects, by which they exercised their right of intervention, in the sense that measures to be taken for the deletion, from the evidence of Biroul de Credit, of the negative data transmitted to Biroul de Credit without the prior notification of the data subject, as provided by Article 8 (2) of ANSPDCP Decision no. 105/2007, in violation of the provisions of Article 12 of the Law no. 677/2001.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 in the form of non-observance of the rights of intervention and information, rights provided by Article 14 (1) and Article 12 (1), in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with the provisions of Articles 8 and 9 of Decision 105/2007, since the applicant – Banca Românească SA – Member of the National Bank of Greece Group did not comply with the requests of the data subjects, by which they exercised their right of intervention, in the sense that measures to be taken for the deletion, from the evidence of Biroul de Credit, of the negative data transmitted to Biroul de Credit without the prior notification of the data subject, as provided by Article 8 (2) of ANSPDCP Decision no. 105/2007, in violation of the provisions of Article 12 of the Law no. 677/2001.

For these facts, fines were imposed in total amount of 25.000 lei, maintained by final decision by the court.

       5. Easy Asset Management SA

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, since Easy Asset Management IFN SA transmitted negative data to Biroul de Credit, for 5 persons, without proving their prior information, in violation of the provisions of Article 8 (2), Article 9 (1) of Decision no. 105/2007 and Article 12 (1) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007;
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 due to the fact that Easy Asset Management IFN SA transmitted negative data, for 5 persons, to Biroul de Credit before the 30-days deadline from the due date expired, contrary to the provisions of Article 5 (1) of ANSPDCP Decision no. 105/2007, in violation of Article 4 (1) a) and c) of Law no. 677/2001, corroborated with Article 12 of ANSPDCP Decision no. 105/2007.

For these facts, fines were imposed in total amount of 25.000 lei, maintained by final decision by the court.

      6. SC ERB Retail Services IFN SA

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 with the disregard of the right provided by Article 14 (1) and (3) of Law no. 677/2001, as ERB Retail Services IFN SA did not comply with the request of the data subjects (4 petitioners), through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice.

For these facts, fines were imposed in total amount of 10.000 lei, maintained by final decision by the court.

       7. Simplu Credit IFN SA

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001 because Simplu Credit IFN SA transmitted negative data related to the credit agreement concluded with the data subject (client-petitioner), without providing the proof of prior notification thereof, 15 days before the transmission of the negative data to Biroul de Credit, as provided by Article 8 (2) and Article 9 of ANSPDCP Decision no. 105/2007, and it transmitted inaccurate and incorrect data contrary to the provisions of Article 4 (2) of the same decision and before 30 days from the maturity date, contrary to the provisions of Article 5 (1) of the same decision, in breach of the provisions of Article 4 a) and c) and Article 12 of Law no. 677/2001;
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right provided by Article 14 (1) of Law no. 677/2001, as Simplu Credit IFN SA did not comply with the request of a data subjects (client-petitioner), through which he/she exercised his/her right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without his/her prior notice.

For these facts, fines were imposed in total amount of 5.000 lei, maintained by final decision by the court.

       8. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 5 (1), Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of the data subjects (2 petitioners), through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that the bank could not provide evidence of their prior notice of their registration, including the mention “account purchased by another creditor”, 15 days before the transmission of negative data to Biroul de Credit, pursuant to Articles 8 and 9 of Decision no. 105/2007 and did not observe the provisions of Article 5 (1) of Decision no. 105/2007.

For these facts, fines were imposed in total amount of 8.000 lei, maintained by final decision by the court.

      9. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of a data subject, through which he/she exercised his/her right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that the bank did not accomplished the prior information of the data subject, 15 days before the transmission of negative data to Biroul de Credit.

For these facts, fines were imposed in total amount of 10.000 lei, maintained by final decision by the court.

      10. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of the data subjects, 15 days before the transmission of negative data to Biroul de Credit, including the mention “account purchased by another creditor”, pursuant to Articles 8 and 9 of Decision no. 105/2007.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of the data subjects, 15 days before the transmission of negative data to Biroul de Credit, pursuant to Articles 8 and 9 of Decision no. 105/2007.

For these facts, fines were imposed in total amount of 11.000 lei, maintained by final decision by the court.

      11. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of the data subjects, 15 days before the transmission of negative data to Biroul de Credit, pursuant to Articles 8 and 9 of Decision no. 105/2007 and it did not observe the provisions of Article 5 (1) of Decision no. 105/2007.

For these facts, fines were imposed in total amount of 11.000 lei, maintained by final decision by the court.

      12. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 5 (1), Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense of deletion of all negative data from Biroul de Credit which were not in compliance with the provisions of Articles 8 and 9 of Decision no. 105/2007.

For these facts, fines were imposed in total amount of 15.000 lei, maintained by final decision by the court.

       13. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of a data subject (petitioner), through which he/she exercised his/her right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of the data subject, 15 days before the transmission of negative data to Biroul de Credit, pursuant to Articles 8 and 9 of Decision no. 105/2007 and it answered the petitioner by exceeding the 15 days deadline provided by Article 14 (3) of Law no. 677/2001, for which a fine of 12000 lei was imposed.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, by infringing the provisions of Article 14 of Law no. 677/2001 in relation to Article 12 and Article 4 (1) of the same law, corroborated with Article 8, Article 9 and Article 12 of Decision no. 105/2007 because SC Banca Comercială Română SA did not comply with the requests of certain data subjects (8 petitioners), through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit, by taking into account that the bank did not provide evidence of the prior information of the data subjects, 15 days before the transmission of negative data to Biroul de Credit, including the mention “account purchased by another creditor”, pursuant to Articles 8 and 9 of Decision no. 105/2007 and it answered the petitioner by exceeding the 15 days deadline provided by Article 14 (3) of Law no. 677/2001, for which a fine of 12000 lei was imposed.

       14. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right of intervention and right to information provided by Article 14 (1) and Article 12 (1) in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with Article 8 of Decision no. 105/2007, as SC Banca Comercială Română SA did not comply entirely with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice, as provided by Article 8 (2) of Decision no. 105/2007, in breach of Article 12 of Law no. 677/2001.

For these facts, fines were imposed in total amount of 25.000 lei, maintained by final decision by the court.

     15. SC Banca Comercială Română SA

The following facts were found:

  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right of intervention and right to information provided by Article 14 (1) and (3) and Article 12 (1) in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with Articles 8 and 9 of Decision no. 105/2007, as SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of all the data subjects, 15 days before the transmission of negative data to Biroul de Credit, including the mention “account purchased by another creditor”, pursuant to Articles 8 and 9 of Decision no. 105/2007.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right of intervention and right to information provided by Article 14 (1) and (3) and Article 12 (1) in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with Articles 8 and 9 of Decision no. 105/2007, as SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of all the data subjects, 15 days before the transmission of negative data to Biroul de Credit, including the mention “account purchased by another creditor”, pursuant to Articles 8 and 9 of Decision no. 105/2007.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right of intervention and right to information provided by Article 14 (1) and (3) and Article 12 (1) in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with Articles 8 and 9 of Decision no. 105/2007, as SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of all the data subjects, 15 days before the transmission of negative data to Biroul de Credit, including the mention “account purchased by another creditor”, pursuant to Articles 8 and 9 of Decision no. 105/2007.
  • “Illegal processing of personal data”, provided by Article 32 of Law no. 677/2001, with the disregard of the right of intervention and right to information provided by Article 14 (1) and (3) and Article 12 (1) in relation to Article 4 (1) a) of Law no. 677/2001, corroborated with Articles 8 and 9 of Decision no. 105/2007, as SC Banca Comercială Română SA did not comply with the requests of certain data subjects, through which they exercised their right of intervention, in the sense that measures to be taken for the deletion of the negative data submitted to Biroul de Credit without their prior notice, by taking into account that, until the date of the report of investigation, the bank did not provide evidence of the prior information of all the data subjects, 15 days before the transmission of negative data to Biroul de Credit, pursuant to Articles 8 and 9 of Decision no. 105/2007.

For these facts, fines were imposed in total amount of 40.000 lei, maintained by final decision by the court.