The National Supervisory Authority for Personal Data Processing completed, in January current year, an investigation at the controller PPC Energie Muntenia SA and found the breach of Article 5 paragraph (1) letters a) and b), Article 6 and Article 12 paragraphs (3) and (4) of the General Data Protection Regulation (GDPR), in conjunction with Article 15 of the GDPR.

As such, the controller was sanctioned with fine, as follows:

fine of 9,950 lei, the equivalent of 2,000 euros for the infringement of Article 5 paragraph (1) letters a) and b) and of Article 6 of the GDPR;
fine of 4,975 lei, the equivalent of 1,000 euros for the infringement of Article 12 paragraphs (3) and (4), in conjunction with Article 15 of the GDPR.

The investigation was started as a result of a complaint by which the petitioner claimed that he was contacted by phone, for marketing purposes, by a partner of the controller. In this context, the petitioner addressed the controller with a request through which he exercised his rights of access and to object provided by the GDPR, to which he did not receive a reply. Subsequently, the petitioner made a new request, but he was not satisfied with the reply received from the controller.

During the investigation, the National Supervisory Authority found that PPC Energie Muntenia SA processed illegally the personal data of the petitioner (telephone number), by making them available to a partner, for marketing and advertising purposes, without a valid legal basis for the processing, thus infringing the provisions of Article 5 paragraph (1) letters a) and b) and of Article 6 of Regulation (EU) 2016/679.

At the same time, it was found that the controller did not properly manage the requests through which the petitioner exercised his rights of access and to object provided by the GDPR, the reply received not being in accordance with the provisions of Article 12 paragraphs (3) and (4) of Regulation (EU) 2016/679, in conjunction with Article 15 of Regulation (EU) 2016/679.

In the same time, pursuant to the provisions of Article 58 paragraph (2) letters c) and d) of Regulation (EU) 2016/679, the following corrective measures were ordered against the controller PPC Energie Muntenia SA:

to ensure compliance of the personal data processing operations with the GDPR, so that data collected for specific, explicit and legitimate purposes are not subsequently processed in a manner incompatible with these purposes;
to submit a complete reply and in accordance with the applicable legal provisions to requests to exercise the right of access of the petitioner.

Legal and Communication Department

A.N.S.P.D.C.P