The Institution of the Romanian President – Court Ruling (Romania, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Romanian Constitutional Court ruled that a law requiring the lifelong storage of health data was unconstitutional due to lack of safeguards. This matters because it protects individuals' rights to privacy and ensures that personal data is handled responsibly. The ruling encourages lawmakers to create better protections for personal information.
What happened
The Romanian Constitutional Court found that a law requiring the lifelong storage of health data lacked necessary protections for individuals.
Who was affected
Individuals whose health data would have been stored for life without the option for erasure.
What the authority found
The Court ruled that the law was unconstitutional because it did not provide adequate safeguards for data protection, although storing health data for life was not inherently unconstitutional.
Why this matters
This decision highlights the need for laws to include strong protections for personal data. Lawmakers should ensure that any data collection practices respect individuals' rights and privacy.
National Law Articles
The Romanian Constitutional Court examined the constitutionality of the legal provision in Article 2 Governmental Ordinance no. 7/2025 establishing a register for contagious diseases. The Institution of the President of Romania requested the constitutional check. It argued that the measure went beyond what was necessary because the personal data concerning the health of a person were stored for the entirety of that individual’s life with the express prohibition of erasure. This allegedly breached Article 1(3) Romanian Constitution, Article 26 Romanian Constitution, Article 20 Romanian Constitution, as well as Article 8 European Convention on Human Rights (EHCR), Article 148 Romanian Constitution, Article 7 EU Charter of Fundamental Rights (EUCFR) and Article 8(2) EUCFR. Furthermore, the Institution of the President emphasised that the legal provision fails to provide the necessary safeguards for the protection of the fundamental rights and liberties of the individual. Namely, the legal act failed to specify the liability of the controller and the applicable sanctions for breaches, and to ensure the confidentiality of the personal data processing among other shortcomings. This allegedly breached Article 26 Romanian Constitution, Article 1(5) Romanian Constitution, and Article 147(4) Romanian Constitution. The Constitutional Court held that the legal provision was unconstitutional. It found that the legal act failed to provide the necessary safeguards in relation to controller liability, sanctions, and confidentiality. However, the Court found that the measure of storing personal data concerning health for the entire duration of an individual’s life without the possibility of erasure was not in itself unconstitutional and did not violate the fundamental right to private life. The Court pointed out that the aim of such a legal provision is justified by its scientific or statistical purpose and abides by European legal provisions on health safety.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for The Institution of the Romanian President in RO
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. The Institution of the Romanian President - Romania (2026). Retrieved from cookiefines.eu
Last updated: