- Enforcing jurisdiction
- Romania · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Natural Person – €10,000 Fine (Romania, 2026)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A natural person in Romania was fined EUR 10,000 for operating a website that published sensitive personal data. The website shared identity cards containing private information without a legal basis. This case highlights the risks of mishandling personal data online.
What happened
A natural person published identity cards with sensitive personal data on a website without having a legal basis for doing so.
Who was affected
Individuals whose identity cards and personal information were published on the website.
What the authority found
The authority ruled that the individual did not have a sufficient legal basis for processing the sensitive data and failed to respond to deletion requests.
Why this matters
This case illustrates the serious implications of improperly handling personal data online. Website operators must ensure they comply with data protection laws to avoid hefty fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 14 March 2026.
Processing notes: articles corrected, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Romanian DPA has imposed a fine of EUR 10,000 on a natural person. The controller operated a website on which identity cards containing personal data, including special category data, possible criminal convictions, data on the intimate lives of data subjects and possible debts, were published. The processing of this data was not based on a sufficient legal basis, and the controller did not ensure that the data was correct, complete or transparent. Furthermore, the controller did not adequately respond to requests by data subjects to delete their data. Furthermore, the DPA found that the controller did not provide the necessary information on its website, nor did it respond to requests from the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Natural Person in RO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
30 January 2026
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Fine Amount
€10,000
About this data
Cite as: Cookie Fines. Natural Person - Romania (2026). Retrieved from cookiefines.eu
Last updated: