Societatea Națională de Căi Ferate CFR SA – Court Ruling (Romania, 2026)

On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the controller). The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject and police agents in front of a railway station. The controller refused to provide the data subject with the requested footage citing the protection of the rights and interests of other persons in the CCTV images. Subsequently, the data subject filed a complaint with the Romanian DPA (ANSPDCP). The DPA found violations of Article 12(6) GDPR, Article 15(3) GDPR and Article 83(5)(b) GDPR and issued the controller with a warning. Moreover, the DPA ordered the controller, among other things, to provide the requested footage, to the extent that it was still available, while following guidelines about sharing such images. In court, the data subject sued the controller for immaterial damages worth RON 3,500 (€665) claiming that its failure to provide the requested footage led to feelings of frustration, stress, injustice and helplessness by being forced to undertake additional steps to make use of his rights and by making it impossible to use the requested footage in other legal cases. The court held that the DPA’s decision attested the infringement of the data subject’s right to access by the controller, meeting the requirements of an illicit act under Article 1357 Romanian Civil Code. Moreover, the court accepted the data subject’s stress and suffering and the causal link between them and the controller’s access request refusal. Therefore, the court awarded RON 1,000 (€190) in immaterial damages to the data subject in accordance with Article 1381(1) Romanian Civil Code, Article 1381(2) Romanian Civil Code and Article 1385 Romanian Civil Code. At the same time, the court considered that the damage was not severe nor prolonged and took this into account when deciding on the amount of damages awarded. Finally, the court dismissed the data subject’s request to order the controller to provide the requested footage since it had already been deleted.