The National Supervisory Authority for Personal Data Processing completed, in February 2025, an investigation at the operator Noy Business Tranzactions SRL and found a violation of the provisions of art. 12 para. (1)-(4) in relation to art. 15 para. (3) and art. 17 of Regulation (EU) 2016/679.
As such, the operator was fined 4,977.3 lei (equivalent to 1,000 EURO).
The investigation was initiated following a complaint alleging a possible violation of the provisions of Regulation (EU) 2016/679. Thus, a customer complained that the operator did not provide him with a response to his request through which he exercised his right of access to his personal data (image), requesting the video camera recordings, from the period of his stay, at the hotel where he was accommodated, belonging to the operator.
During the investigation, the National Supervisory Authority for Personal Data Processing found that the operator did not communicate within the legal deadline an adequate and complete written response to the person’s request, through which he had exercised both the right of access and the right to deletion of his data.
As such, it was established that the provisions of art. 12 para. (1)-(4) of Regulation (EU) 2016/679, in relation to art. 15 para. (3) and art. 17 of the same European act, were violated.
At the same time, the following corrective measures were also taken against the operator :
- to send a complete response to the request of the data subject, to the contact details indicated by him/her, by securely communicating the requested personal data, to the extent that they are still available, as well as information regarding the deletion of the data, by referring to the provisions of art. 15 para. (3) and (4), art. 17, in conjunction with art. 12 of Regulation (EU) 2016/679;
- to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of appropriate training of the personnel designated for this purpose, so that the operator is able to analyze, correctly resolve and respond appropriately to requests by which data subjects exercise their rights, within the time limits and according to the conditions provided for in art. 12-23 of Regulation (EU) 2016/679.
https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_11.03.2025&lang=ro