Societatea Națională de Căi Ferate CFR SA – Court Ruling (Romania, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Romanian National Railways Company was ordered to provide a person with CCTV footage after they requested it following an incident. The authority found that the company had violated the person's right to access their data. This case emphasizes the importance of transparency and access to personal information.
What happened
A person requested CCTV footage from the Romanian National Railways Company but was initially denied access.
Who was affected
The individual who requested the CCTV footage after an altercation involving police.
What the authority found
The authority found that the company violated the person's right to access their personal data and issued a warning.
Why this matters
This ruling reinforces the right of individuals to access their personal data. Companies should be prepared to fulfill access requests to avoid legal issues.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the controller). The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject and police agents in front of a railway station. The controller refused to provide the data subject with the requested footage citing the protection of the rights and interests of other persons in the CCTV images. Subsequently, the data subject filed a complaint with the Romanian DPA (ANSPDCP). The DPA found violations of Article 12(6) GDPR, Article 15(3) GDPR and Article 83(5)(b) GDPR and issued the controller with a warning. Moreover, the DPA ordered the controller, among other things, to provide the requested footage, to the extent that it was still available, while following guidelines about sharing such images. In court, the data subject sued the controller for immaterial damages worth RON 3,500 (€665) claiming that its failure to provide the requested footage led to feelings of frustration, stress, injustice and helplessness by being forced to undertake additional steps to make use of his rights and by making it impossible to use the requested footage in other legal cases. The court held that the DPA’s decision attested the infringement of the data subject’s right to access by the controller, meeting the requirements of an illicit act under Article 1357 Romanian Civil Code. Moreover, the court accepted the data subject’s stress and suffering and the causal link between them and the controller’s access request refusal. Therefore, the court awarded RON 1,000 (€190) in immaterial damages to the data subject in accordance with Article 1381(1) Romanian Civil Code, Article 1381(2) Romanian Civil Code and Article 1385 Romanian Civil Code. At the same time, the court considered that the damage was no
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Societatea Națională de Căi Ferate CFR SA in RO
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Societatea Națională de Căi Ferate CFR SA - Romania (2026). Retrieved from cookiefines.eu
Last updated: