One United Properties SA – €1,999 Fine (Romania, 2025)

The DPA conducted an ex officio investigation in relation to the telemarketing activities of real estate investor One United Properties SA (the data controller). The investigation revealed several unsolicited commercial messages were sent to different data subjects over a prolonged time period. The controller was not able to prove the consent of the data subjects to the processing of their data for marketing purposes. Additionally, some data subjects requested multiple time to access their data and to have a confirmation of whether their data was being processed or deleted. The controller did not respond to such access request by the data subject. The DPA found that, by not being able to prove the consent of data subjects to the processing, the controller violated Article 6 GDPR. In relation to the access request, the lack of reply within one month of reception of the request, hindered the exercise of rights of the data subject. Thus, the controller violated Article 12(3), 15 and 17 GDPR. Therefore, the DPA found a violation of Articles 6, 12(3), 15 and 17 GDPR. For these reasons, the DPA imposed a fine of RON 9,994 (€2,000). Additionally, the DPA ordered the controller to bring its direct marketing into compliance with the GDPR: 1. By no longer processing personal data without the consent of the data subjects and without the existence of any other legal basis for processing the data subjects' data, including for marketing purposes; 2. By training their staff on how to properly handle data subject access requests.