The National Supervisory Authority for Personal Data Processing, completed, in February of this year, an investigation at the operator Velvet Medical SRL and found a violation of the provisions of art. 12 para. (1) – (4) of the General Data Protection Regulation (GDPR), in relation to art. 15 para. (3) of the GDPR.
As such, the operator was penalized with a fine of 4,976.4 lei, the equivalent of 1,000 EURO .
The investigation was initiated following a complaint by the petitioner alleging the refusal of the operator Velvet Medical SRL to comply with his request to receive medical data, namely the documents from the medical file. Subsequently, the petitioner submitted a new request for access to his data, but the operator did not respond this time either.
During the investigation, the National Supervisory Authority found that Velvet Medical SRL did not present evidence showing that it responded to the petitioner’s request through which he had exercised his right of access to his medical data.
It was also found that the controller did not present evidence of communication of an appropriate and complete response to the second access request of the petitioner addressed to the controller, thus violating the provisions of art. 12 para. (1) – (4) of the GDPR, in relation to art. 15 para. (3) of the GDPR.
At the same time, pursuant to the provisions of art. 58 para. (2) letters c) and d) of Regulation (EU) 2016/679, the operator Velvet Medical SRL was also ordered to take the following corrective measures:
- to send a complete response to the request of the petitioner, by e-mail, from the official address of the operator, by securely communicating the requested personal data, in accordance with the provisions of art. 15 para. (3) and (4) of the GDPR;
- to ensure compliance with the GDPR of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of appropriate training of the personnel designated for this purpose, so that the operator is able to analyze, correctly resolve and respond appropriately to requests by which data subjects exercise their rights, within the deadlines and according to the conditions provided for in art. 12-23 of the GDPR.
https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_27.02.2025&lang=ro