Dt: Created page with “{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=03.02.2026 |ECLI= |Original_Source_Name_1=ANSPDCP |Original_Source_Link_1=https://www.dataprotection.ro/?page=Comunicat_Presa_03_02_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language…”
|Jurisdiction=Romania
|DPA-BG-Color=background-color:#ffffff;
|DPAlogo=LogoRO.jpg
|DPA_Abbrevation=ANSPDCP
|DPA_With_Country=ANSPDCP (Romania)
|Case_Number_Name=03.02.2026
|ECLI=
|Original_Source_Name_1=ANSPDCP
|Original_Source_Link_1=https://www.dataprotection.ro/?page=Comunicat_Presa_03_02_2026&lang=ro
|Original_Source_Language_1=Romanian
|Original_Source_Language__Code_1=RO
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=
|Type=Complaint
|Outcome=Upheld
|Date_Started=
|Date_Decided=
|Date_Published=03.02.2026
|Year=
|Fine=5,089
|Currency=RON
|GDPR_Article_1=Article 12(3) GDPR
|GDPR_Article_Link_1=Article 12 GDPR#3
|GDPR_Article_2=Article 12(4) GDPR
|GDPR_Article_Link_2=Article 12 GDPR#4
|GDPR_Article_3=Article 15 GDPR
|GDPR_Article_Link_3=Article 15 GDPR
|GDPR_Article_4=Article 17 GDPR
|GDPR_Article_Link_4=Article 17 GDPR
|GDPR_Article_5=Article 21 GDPR
|GDPR_Article_Link_5=Article 21 GDPR
|GDPR_Article_6=
|GDPR_Article_Link_6=
|GDPR_Article_7=
|GDPR_Article_Link_7=
|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=
|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=
|Party_Name_1=Partidul Alianța pentru Unirea Românilor (AUR)
|Party_Link_1=
|Party_Name_2=
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=
|Initial_Contributor=
|
}}
The DPA fined a political party RON 5,089 (€1,000) for failing to respond to a request for access, erasure and objection in relation to personalised electoral mail during the presidential elections.
== English Summary ==
=== Facts ===
The DPA received a complaint from an individual (the data subject) regarding Partidul Alianța pentru Unirea Românilor (the controller), a Romanian political party.
The controller sent personalised electoral mail to the data subject during the campaign for the 2025 Romanian presidential elections.
The data subject made a request exercising their rights to access, erasure and objection to the communications, however, the controller failed to respond to the request.
=== Holding ===
The DPA took note of the controller’s failure to respond to the data subject’s request in violation of [[Article 12 GDPR#3|Article 12(3) GDPR]], [[Article 12 GDPR#4|Article 12(4) GDPR]] in relation to [[Article 15 GDPR|Article 15 GDPR]], [[Article 17 GDPR|Article 17 GDPR]], and [[Article 21 GDPR|Article 21 GDPR]].
Therefore, it fined the controller RON 5,089 (€1,000) and ordered it to respond to the request and to ensure compliance with [[Article 15 GDPR|Article 15 GDPR]], [[Article 17 GDPR|Article 17 GDPR]] and [[Article 21 GDPR|Article 21 GDPR]].
== Comment ==
”Share your comments here!”
== Further Resources ==
”Share blogs or news articles here!”
== English Machine Translation of the Decision ==
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
<pre>
03.02.2026
Sanction for violation of the GDPR
The National Supervisory Authority for Personal Data Processing completed, in January 2026, an investigation at the controller, the Alliance for the Unity of Romanians Party (AUR) and found a violation of the provisions of art. 12 para. (3) and (4) in relation to art. 15, art. 17 and art. 21 of Regulation (EU) 2016/679.
As such, the controller was sanctioned with a fine of 5,089 lei (equivalent to 1,000 EURO).
The investigation was initiated following a complaint received from a natural person.
During the investigation, it was found that the operator did not communicate a response to the request of the data subject through which he exercised his rights of access, deletion and opposition, in the context of receiving a personalized letter with electoral content within the campaign for the presidential elections of 2025.
At the same time, the following corrective measures were also ordered towards the operator:
to send a written response to the request of the data subject, in relation to art. 15, art. 17 and art. 21 of Regulation (EU) 2016/679; to ensure compliance with Regulation (EU) 2016/679 of personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of appropriate training of the staff designated for this purpose, so that the operator analyzes, correctly resolves and responds to all requests through which the data subjects exercise their rights, within the deadlines and according to the conditions provided for in art. 12-22 of Regulation (EU) 2016/679.
Legal and Communication Department
A.N.S.P.D.C.P.
</pre>