In April 2024 the National Supervisory Authority for Personal Data Processing closed an investigation on the S.C. Tensa Art Design S.A data controller, owner of the www.lensa.ro website, and found an infringement on Article 6 of Regulation (EU) 2016/679 (GDPR), by reference to Article 85(5)(a) of the same legal act.

As such, the controller was sanctioned with a fine in the amount of 9,941 Lei the equivalent of 2,000 EUR.

The investigation was launched following a complaint to the National Supervisory Authority for Personal Data Processing indicating that the data controller S.C. Tensa Art Design S.A., owner of the www.lensa.ro website, processed the complainant’s phone number for direct marketing purposes, without their consent, and sending commercial messages (SMS) informing the complainant on company offers.

During the investigation, it was found that the controller S.C. Tensa Art Design S.A. has not provided proof on the complainant’s consent or any other legal base for the processing of the data of the complainant for direct marketing purposes, thus breaching the provisions of Article 6 of the GDPR, by reference to Article 85(5)(a) of Regulation (EU) 2016/679.

At the same time, in line with the provisions of Article 58(2)(d) of the GDPR, the following corrective measure was ordered against Tensa Art Design S.A.:

To take the necessary measures to ensure future compliance with the provisions of the GDPR, i.e. to avoid the processing of personal data without the consent of the data subjects or without a legal basis for the processing of personal data for direct marketing purposes, in accordance with Article 6 of the GDPR.

Legal and Communication Department

A.N.S.P.D.C.P.