- Enforcing jurisdiction
- Romania · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
ANSPDCP – Court Ruling (Romania, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Romanian court annulled a fine against a company for unlawfully processing employee data through surveillance cameras. The court found that the DPA did not provide enough details about the violations. This ruling shows that authorities must clearly outline violations for their decisions to be upheld.
What happened
The court annulled a decision by the Romanian DPA that fined a company for unlawfully processing employee data.
Who was affected
The company that was fined by the Romanian DPA for alleged unlawful data processing activities involving its employees.
What the authority found
The court decided that the DPA failed to specify the violations committed by the company, leading to the annulment of the fine.
Why this matters
This ruling indicates that regulatory bodies must clearly articulate the basis for their decisions. Companies should ensure they understand the specific legal requirements to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Romanian DPA issued a fine to a company (the controller) in April 2025 for the unlawful processing of its employees’ personal data via surveillance cameras in one of its storage facilities in violation of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR, Article 6(1) GDPR, and Article 5 Law no. 190/2018 (Legea nr. 190/2018). The controller appealed the DPA’s decision in court arguing, among other things, that the DPA failed to indicate the specific violation committed and the specific time and date. The controller asked the court to annul the DPA’s decision. The court found that the DPA failed to provide a concrete description of the violations committed by the controller. The court noted that the DPA’s decision only provided a generic mention that the personal data processing activities carried out by the controller were in breach of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR and Article 6(1) GDPR along with Article 5 Law nr. 190/2018. Furthermore, the court found that the DPA’s decision failed to identify and mention the exact date and context of the alleged unlawful processing activities. Instead, the decision only specified that the processing began in 2017. Therefore, the court upheld the controller’s appeal against the DPA’s decision and annulled said decision.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for ANSPDCP in RO
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
10 December 2025
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
GDPRhub ID
gdprhub-court-9759About this data
Cite as: Cookie Fines. ANSPDCP - Romania (2025). Retrieved from cookiefines.eu
Last updated: