Societatea Civilă Medicală Policlinica Tommed – €2,000 Fine (Romania, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The medical clinic disclosed a patient’s personal information, including health data, to another controller without complying with lawful-processing conditions and without informing the patient beforehand. ANSPDCP imposed RON 9,898, stated as EUR 2,000, under Articles 5(1)(a), (b) and (f), 5(2), in conjunction with Article 9. It ordered compliant collection and further processing to prevent unlawful disclosure, including suitable security and confidentiality safeguards, regular staff training and appropriate DPO involvement. The official announcement reports investigation completion in 2021-11, without an exact decision day. Its later publication date is retained as a publication fact rather than the action date.
What happened
The medical clinic disclosed a patient’s personal information, including health data, to another controller without complying with lawful-processing conditions and without informing the patient beforehand.
Who was affected
The original announcement identifies Societatea Civilă Medicală Policlinica Tommed as the sanctioned Romanian controller.
What the authority found
ANSPDCP imposed RON 9,898, stated as EUR 2,000, under Articles 5(1)(a), (b) and (f), 5(2), in conjunction with Article 9. It ordered compliant collection and further processing to prevent unlawful disclosure, including suitable security and confidentiality safeguards, regular staff training and appropriate DPO involvement.
Why this matters
Articles 37-39 are cited in the corrective-measure discussion about DPO involvement. They are not represented as separate announced infringement findings or additional fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The medical clinic disclosed a patient’s personal information, including health data, to another controller without complying with lawful-processing conditions and without informing the patient beforehand. ANSPDCP imposed RON 9,898, stated as EUR 2,000, under Articles 5(1)(a), (b) and (f), 5(2), in conjunction with Article 9. It ordered compliant collection and further processing to prevent unlawful disclosure, including suitable security and confidentiality safeguards, regular staff training and appropriate DPO involvement. Articles 37-39 are cited in the corrective-measure discussion about DPO involvement. They are not represented as separate announced infringement findings or additional fines. The official announcement reports investigation completion in 2021-11, without an exact decision day. Its later publication date is retained as a publication fact rather than the action date. Appeal status is not established by the announcement.
Related Enforcement Actions (0)
No other enforcement actions found for Societatea Civilă Medicală Policlinica Tommed in RO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
November 2021
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Fine Amount
€2,000
9,898 RON
GDPRhub ID
gdprhub-4437About this data
Cite as: Cookie Fines. Societatea Civilă Medicală Policlinica Tommed - Romania (2021). Retrieved from cookiefines.eu
Last updated: