ANSPDCP – Court Ruling (Romania, 2026)

A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him for the placement of optional cookies onto users’ devices when visiting his website, as well as for failing to inform data subjects of the processing of their personal data via the contact form available on the website. The DPA sanctioned the controller a total of RON 50,286.80 (approximately €10,000) for breaching Article 4(5)(a) & (b) Romanian Law no. 506/2004 transposing e-Privacy Directive 2002/58 and Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The controller claimed in its appeal that, among other things, the DPA failed to include in its decision the complete mandatory information prescribed by administrative law, that the cookies placed on the users’ devices were necessary, and that data subjects were informed of the processing activities on the website. Therefore, the controller requested the annulment of the DPA decision. The court dismissed the controller’s appeal. It found that the website links directing to the privacy policy and information notice were not functional, but that they became functional following communications from the DPA to the controller. Furthermore, the court noted that website users did not have a clear and visible way of providing consent to the use of cookies on the website. Moreover, the court found that the DPA decision contained most of the necessary information required by law. The court noted that the missing information referred only to the objections of the controller. However, the court emphasised that such an omission did not require the annulment of the DPA decision, since the controller was able to raise his objections during the appeal. Finally, the court emphasised the electoral context in which the violations occurred, pointing out that the increased danger for the unlawful processing of the personal data collected via the website at that time. Therefore, the court dismissed the controller’s appeal an