Contrary to the private sector, where the sanctions regime is provided by Article 83 (4) and (5) of the General Data Protection Regulation (GDPR), in the case of the public sector in Romania, the sanctions regime is different and phased, as provided by Law no. 190 of 18 July 2018, as follows:

In the first phase, the lawmaker provided that in case of a violation of the GDPR and of the Law no. 190/2018 by public authorities and bodies, the National Supervisory Authority for Personal Data Processing shall first apply the mandatory sanction of a reprimand accompanied by a remedial plan, as provided by Article 13 of Law no. 190/2018
Further, in the second phase, only if it is found that national authorities/bodies have not fulfilled the measures set in the remedial plan, the National Supervisory Authority for Personal Data Processing may apply the civil sanction of a fine, as provided by Article 14 of Law no. 190/2018.

We mention that in the public sector the fines start from 10,000 lei and can reach 200,000 lei, as provided by Article 14 of Law no. 190/2018.

The different sanctions regime for public sector controllers is regulated by Law no. 190/2018, according to the provisions of Article 83 (7) of the GDPR providing that each Member State lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State.

In this context, we highlight, that many EU Member States do not apply fines for public authorities/bodies.

At the same time, we mention that in its news briefings the National Supervisory Authority for Personal Data Processing mainly reports the issued fines, in a similar manner to that of other national data processing authorities in the EU.

With regards to reprimands, we mention that further information is available in annual activity reports, section “General Information” – “Information of Public Interest” – “Annual Reports”.

Thus, in 2022, there were 134 reprimands issued to controllers in the public and private sector, while in 2023, 186 reprimands were issued.

Legal and Communication Department

A.N.S.P.D.C.P.