罗马尼亚ANSPDCP对布加勒斯特第一区市政当局的罚款
Romanian ANSPDCP Fines Bucharest Sector 1 Municipality for Non-Compliance with Information Requests
罗马尼亚数据保护局（ANSPDCP）对布加勒斯特第一区市政当局处以10,000列伊（约2,010.38欧元）的罚款。该市政当局因未能遵守ANSPDCP根据《GDPR》第58(1)(a)和(e)条提出的提供信息和获取数据请求而受到处罚。调查源于对市政当局能源补贴计划数据收集方式的投诉，市政当局未能按期提供调查所需信息，最终被认定违反了《GDPR》相关条款，并被要求提供所有必要信息。
1. 法律意义和背景上下文: 本案是罗马尼亚数据保护局（ANSPDCP）对布加勒斯特第一区市政当局实施的一项监管行动，凸显了《通用数据保护条例》（GDPR）赋予数据保护机构（DPA）的广泛调查权和纠正权。此案的背景是市政当局在实施一项能源补贴计划时，其数据收集方式引发了投诉。更深层次的意义在于，它强调了所有数据控制者（包括公共机构）在面对DPA调查时，有义务积极配合并提供必要信息，否则将面临处罚。这对于确保DPA能够有效履行其监督和执法职责至关重要，也反映了欧盟成员国对GDPR的严格执行态度。
2. 核心法律问题和推理: 核心法律问题在于市政当局是否履行了《GDPR》第58(1)(a)和(e)条规定的义务，即配合DPA的调查，提供信息并允许DPA获取个人数据。ANSPDCP的推理是，市政当局在收到投诉后，未能对DPA的多次信息请求作出回应，也未能在警告后按期采取补救措施提供信息。这种不作为被认定为违反了DPA的调查权，因此DPA有权根据《GDPR》第58(2)(d)条施加纠正措施和罚款。尽管最初的投诉可能涉及数据收集的合法性，但最终的处罚是针对未能配合监管机构调查的行为。
3. 引用的关键法律条款: 本案主要引用了《GDPR》的以下条款： - 第58(1)(a)条：DPA有权命令控制者和处理者提供DPA履行职责所需的所有信息。 - 第58(1)(e)条：DPA有权获取所有个人数据和DPA履行职责所需的其他信息。 - 第58(2)(d)条：DPA有权命令控制者和处理者遵守数据主体的请求，行使其根据本条例享有的权利。 - 此外，还提到了罗马尼亚本国法律《第190/2018号法》第14(5)(e)条，该法是GDPR在罗马尼亚的实施细则。
4. 对平台运营商和合规实践者的影响: 本案对所有数据控制者（包括平台运营商和公共机构）发出了明确信号：与数据保护机构的合作是强制性的。未能及时、准确地回应DPA的信息请求将导致严重的后果，即使原始投诉可能不直接导致罚款。合规实践者应确保其组织内有明确的流程来处理DPA的调查请求，包括指定负责人、建立内部沟通渠道和确保信息可追溯性。任何拖延或不配合都可能被视为违反GDPR，并导致罚款和纠正措施。这要求企业和机构不仅要遵守数据处理原则，还要遵守监管机构的调查程序。
5. 与类似案例或监管趋势的比较: 此类因不配合DPA调查而被罚款的案例在欧盟并不少见。许多DPA都曾对未能回应信息请求、未能提供完整或准确信息的数据控制者处以罚款。例如，爱尔兰DPC也曾因Meta等公司未能及时回应信息请求而采取行动。这表明，欧盟各成员国的DPA在行使其调查权方面保持了一致的强硬立场。监管趋势是DPA越来越注重对程序性违规（如不配合调查）的执法，因为这直接影响了其监管效率和权威性。因此，数据控制者必须将DPA的调查视为高度优先事项，并投入必要的资源来确保全面合规。
原文正文
# ANSPDCP (Romania) - 31.01.2024
From GDPRhub
Jump to: [navigation](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#mw-navigation), [search](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#p-search)
| ANSPDCP - 31.01.2024 | | --- | | [](https://gdprhub.eu/index.php?title=File:LogoRO.jpg) | | Authority: | [ANSPDCP (Romania)](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania) "ANSPDCP (Romania)") | | Jurisdiction: | [Romania](https://gdprhub.eu/index.php?title=Category:Romania "Category:Romania") | | Relevant Law: | [Article 58(1)(a) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#1a "Article 58 GDPR")<br>[Article 58(1)(e) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#1e "Article 58 GDPR")<br>[Article 58(2)(d) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#2d "Article 58 GDPR")<br>[Law 190/2018](https://lege5.ro/App/Document/gi4dsnjugi2q/legea-nr-190-2018-privind-masuri-de-punere-in-aplicare-a-regulamentului-ue-2016-679-al-parlamentului-european-si-al-consiliului-din-27-aprilie-2016-privind-protectia-persoanelor-fizice-in-ceea-ce-priv) | | Type: | Investigation | | Outcome: | Violation Found | | Started: | | | Decided: | | | Published: | 16.07.2036 | | Fine: | 10,000 RON | | Parties: | n/a | | National Case Number/Name: | 31.01.2024 | | European Case Law Identifier: | n/a | | Appeal: | n/a | | Original Language(s): | [Romanian](https://gdprhub.eu/index.php?title=Category:Romanian "Category:Romanian") | | Original Source: | [Ro DPA (in RO)](https://www.dataprotection.ro/?page=Comunicat_Presa_31_01_2024&lang=ro) | | Initial Contributor: | maxinescu |
The Romanian DPA sanctioned the local municipality of 1st district, Bucharest, €2,010.38 for the failure to comply with the requests of the DPA to provide information and obtain access to personal data and information necessary for performing its tasks, pursuant to [Article 58(1)(a) and (e) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#1 "Article 58 GDPR").
## Contents
- [1English Summary](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#English_Summary) - [1.1Facts](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#Facts) - [1.2Holding](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#Holding) - [2Comment](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#Comment) - [3Further Resources](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#Further_Resources) - [4English Machine Translation of the Decision](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024#English_Machine_Translation_of_the_Decision)
## English Summary
### Facts
The DPA initiated an investigation into the local municipality of the 1st district in Bucharest (the controller) after receiving several referrals alleging a possible infringement of the GDPR.
The notices regarded the financial incentives of the programme "Local measures to ensure energy needs and energy efficiency in households in Sector 1". By decisions of the Local Council, it was established how the inhabitants of Sector 1 could submit the necessary documents to benefit from the financial incentives of the programme: in physical format or via e-mail. However, the controller had made available also an online platform for data collection that had been purchased before the decision was approved by the Local Council.
### Holding
During the investigation, the controller failed to respond to the Romanian DPA's repeated requests for information in accordance with the provisions of [Article 58(1)(a) and (e) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#1 "Article 58 GDPR"), which led to the DPA issuing a warning to the controller. At the same time, the DPA ordered the controller a remedial measure, namely, to provide all the requested information to the DPA.
Since the controller did not carry out the measures under the remediation plan within the deadline set by the authority, as the controller did not reply to the DPA request to provide the relevant documents and information, the latter imposed a fine of €2,010.38 for the failure to comply with the provisions of [Article 58(1)(a) and (e) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#1 "Article 58 GDPR").
At the same time, during the investigation, in accordance with [Article 58(2)(d) GDPR](https://gdprhub.eu/index.php?title=Article_58_GDPR#2d "Article 58 GDPR"), the DPA also imposed on the controller the corrective measure to provide and communicate all the requested information, necessary to assess the aspects subject of the investigation.
## Comment
Unfortunately, the Romanian DPA does not publish its full decisions.
## Further Resources
_Share blogs or news articles here!_
## English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
31.01.2024
Penalty for GDPR violation
The National Supervisory Authority for the Processing of Personal Data completed in December 2023 an investigation at the operator Sector 1 of the Municipality of Bucharest and found a violation of the provisions of art. 58 para. (1) lit. a) and e) from Regulation (EU) no. 2016/679 and art. 14 para. (5) lit. e) from Law no. 190/2018.
As such, the operator was penalized with a fine of 10,000 lei.
The investigation was started as a result of notifications that claimed a possible violation of the provisions of Regulation (EU) no. 2016/679.
Thus, the operator of Sector 1 of the Municipality of Bucharest, through the decisions of the Local Council, established the way in which the inhabitants of Sector 1 can submit the necessary documents to benefit from the financial incentives of the program "Local measures aimed at ensuring energy needs and improving the efficiency of energy consumption in households from Sector 1", respectively in physical format or on an e-mail address, established strictly for the purpose of implementing the program. However, Sector 1 of the Municipality of Bucharest made available to the beneficiaries an online platform, https://ticheteanticriza.primarias1.ro, for data collection, purchased before the draft decision was debated and approved by the Local Council.
During the investigation, the operator did not respond to the repeated requests for information sent by the National Authority for the Supervision of Personal Data Processing.
Therefore, as the operator did not provide the information requested by our institution, considering the operator's status as a public institution according to the provisions of Law no. 190/2018, he was sanctioned with a warning. At the same time, it was ordered to apply a remedial measure consisting in the provision/communication of all the requested information.
Since the operator of Sector 1 of the Municipality of Bucharest did not carry out the previously ordered measure through a remedial plan, within the deadline set by the authority, the investigation continued.
Considering that the operator did not prove the fulfillment of the ordered remedial measure, the National Supervisory Authority for the Processing of Personal Data fined Sector 1 of the Municipality of Bucharest for violating the provisions of art. 58 para. (1) lit. a) and lit. e) from Regulation (EU) no. 2016/679 and art. 14 para. (5) lit. e) from Law no. 190/2018.
At the same time, during the investigation, in accordance with the provisions of art. 58 para. (2) lit. d) from Regulation (EU) no. 2016/679, the National Supervisory Authority for the Processing of Personal Data applied to the operator the corrective measure to provide/communicate all the requested information, necessary for the resolution of the reported issues.
Legal and Communication Department
A.N.S.P.D.C.P.
Retrieved from " [https://gdprhub.eu/index.php?title=ANSPDCP\_(Romania)\_-\_31.01.2024&oldid=39802](https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_31.01.2024&oldid=39802)"
[Categories](https://gdprhub.eu/index.php?title=Special:Categories "Special:Categories"):
- [ANSPDCP (Romania)](https://gdprhub.eu/index.php?title=Category:ANSPDCP_(Romania) "Category:ANSPDCP (Romania)") - [Romania](https://gdprhub.eu/index.php?title=Category:Romania "Category:Romania") - [Article 58(1)(a) GDPR](https://gdprhub.eu/index.php?title=Category:Article_58(1)(a)_GDPR "Category:Article 58(1)(a) GDPR") - [Article 58(1)(e) GDPR](https://gdprhub.eu/index.php?title=Category:Article_58(1)(e)_GDPR "Category:Article 58(1)(e) GDPR") - [Article 58(2)(d) GDPR](https://gdprhub.eu/index.php?title=Category:Article_58(2)(d)_GDPR "Category:Article 58(2)(d) GDPR") - [Romanian](https://gdprhub.eu/index.php?title=Category:Romanian "Category:Romanian")
This page was last edited on 14 February 2024, at 16:14.
Content is available under [Creative Commons Attribution-NonCommercial-ShareAlike](https://creativecommons.org/licenses/by-nc-sa/4.0/) unless otherwise noted.