ANSPDCP – Court Ruling (Romania, 2025)

The Romanian DPA issued a fine to a company (the controller) in April 2025 for the unlawful processing of its employees’ personal data via surveillance cameras in one of its storage facilities in violation of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR, Article 6(1) GDPR, and Article 5 Law no. 190/2018 (Legea nr. 190/2018). The controller appealed the DPA’s decision in court arguing, among other things, that the DPA failed to indicate the specific violation committed and the specific time and date. The controller asked the court to annul the DPA’s decision. The court found that the DPA failed to provide a concrete description of the violations committed by the controller. The court noted that the DPA’s decision only provided a generic mention that the personal data processing activities carried out by the controller were in breach of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR and Article 6(1) GDPR along with Article 5 Law nr. 190/2018. Furthermore, the court found that the DPA’s decision failed to identify and mention the exact date and context of the alleged unlawful processing activities. Instead, the decision only specified that the processing began in 2017. Therefore, the court upheld the controller’s appeal against the DPA’s decision and annulled said decision.