The National Supervisory Authority finalized, in June 2021, an investigation at the controller La Santrade SRL and found the breach of the provisions of Article 83 paragraph (5) letter e) from the General Data Protection Regulation and the breach of the provisions of Article 83 paragraph (5) letter b) of the General Data Protection Regulation.

Therefore, the controller was sanctioned:

with a fine in amount of Lei 9,839.4 (the equivalent of EUR 2,000) for the breach of Article 83 paragraph (5) letter e) of the General Data Protection Regulation, referring to the obligation of the controller to provide the necessary information to the National Supervisory Authority;
with a reprimand, for the breach of the provisions of Article 83 paragraph (5) letter b) of the General Data Protection Regulation regarding the non-observance of the rights of the data subject.

Within the investigation started following a complaint, La Santrade S.R.L. did not respond to the request for information addressed by the National Supervisory Authority within the exercise of its attributions, thus breaching the provisions of Article 83 paragraph (5) letter e) of the General Data Protection Regulation.

Also, the National Supervisory Authority found that the controller did not adopt measures in order to ensure the effective exercise of the rights of the data subjects, which led to the lack of settlement of the request of the data subject that was requesting the erasure of his personal data (right provided under Article 17 of the General Data Protection Regulation). In this context, it was established that the provisions of Article 12 paragraphs (2) and (3) of the General Data Protection Regulation have not been observed.

Also, the following two corrective measures have been imposed to the company La Santrade S.R.L.:

the corrective measure to inform the data subject in relation to the measures adopted for the erasure of his/her data, collected without his/her specific consent;
the corrective measure to facilitate the exercise of the rights of the data subject, by making available some valid contact data, including a functional e-mail address, following for these to be publicly displayed on the website of the controller, within the sections regarding the processing of personal data, confidentiality policy, contact data.

Legal and Communication Department

ANSPDCP