SC Grupex 2000 SRL – €1,000 Fine (Romania, 2022)

The Romanian DPA started an investigation against the news website SC Grupex 2000 SRL after a regional Social Assistance and Child Protection Agency notified the DPA that video recordings of some of their hospitalised patients were published on its website. The Romanian DPA held that the publishing of these recordings constituted an unlawful processing of personal data in breach of Articles 6 and 9 GDPR, with reference to the principles in Article 5(1)(a), (b), (c), (f) and 5(2) GDPR. Based on these considerations, the DPA issued a fine of approximately €1000 (RON 4943.60) against the website. Additionally, the Romanian DPA also ordered the website to implement appropriate technical and organisational measures to ensure compliance with GDPR.