The National Supervisory Authority for Personal Data Processing completed, in December 2024, an investigation at the operator RED&WHITE 2022 MANAGEMENT SA and found a violation of the provisions of art. 28 para. (3) letter a) of Regulation (EU) 2016/679.

For the acts committed, the operator was fined 24,854.50 lei (the equivalent of 5,000 euros).

The investigation into the sanctioned operator was initiated following issues notified to the Authority by the operator, respectively by an authorized representative of the operator, regarding a possible violation of the provisions of Regulation (EU) 2016/679 in the context of a crowdfunding campaign (microfinancing from individuals).

The investigation found that the operator, as the majority shareholder of a football team, sent an email regarding the possibility of financing the team by its supporters, to a database consisting of a very large number of emails of data subjects who had purchased tickets to the team’s matches. The email was sent through an authorized person of the operator, and the database used contained personal data (surname, first name, email address) of both the club’s supporters (supporters) and other individuals.

In this context, the operator did not provide evidence of the development of documented instructions for its processor regarding the category (supporters) of data subjects from the database used, to whom the processor sent the email, designed and approved by the operator, about the funding campaign.

It is worth noting that Regulation (EU) 2016/679 provides in Article 28(3) that “Processing by a processor shall be governed by a contract or other legal act under Union or national law to which the processor is bound in relation to the controller and which sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects and the obligations and rights of the controller. (…)” .

In addition, the aforementioned article regulates, among other things, that the respective contract or legal act specifically provides that the person empowered by the operator processes personal data only on the basis of ” documented instructions from the operator “.  

https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_30_01_2025&lang=ro