The National Supervisory Authority finalised on 07.01.2022 an investigation at the controller Grupex 2000 SRL, occasion with which the breach of the provisions of Article 6 and Article 9 corroborated with the principles provided under Article 5 paragraph (1) letters a), b), c) and f) and paragraph (1) of the General Data Protection Regulation was found.

Therefore, the controller was sanctioned with a fine in amount of Lei 4,943.60 (the equivalent of EUR 1,000).

The investigation was started following the communication of some intimations from a County Service for Social Assistance and Child Protection, having as object the posting of a video material containing images of sick persons, published on the website owned by Grupex 2000 S.R.L..

Within the investigation it was found that Grupex 2000 S.R.L. has illegally processed the personal date of some natural persons, institutionalised sick persons, within a recorded material available on the website of the controller, by breaching the provisions of Article 6 and Article 9 corroborated with the principles provided under Article 5 paragraph (1) letters a), b), c) and f) and paragraph (2) of the GDPR.

Also, within the investigation, the corrective measure to ensure the compliance with the GDPR of the personal data processing operations, through the implementation of some appropriate technical and organisation measures, with the observance of Article 5 and Article 6 GDPR, was applied to the controller.

Legal and Communication Department

A.N.S.P.D.C.P.