RomaniaLaw 506/2004 on the Processing of Personal Data and the Protection of Privacy in Electronic Communications (Legea nr. 506/2004), Article 12, Unsolicited Communications
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/56973In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Send commercial communications through automatic calling and communication systems that need no human operator, through fax or electronic mail, or through any other method that uses publicly available electronic communications services, only to a subscriber or user who has first given express consent (article 12, paragraph 1).NIST Privacy FrameworkCT.PO-P1
- You need no prior consent to use a client's electronic mail address, which you obtained directly when selling the client a product or service, for commercial communications about your own similar products or services, but you must clearly and expressly offer a simple and free way to object when you obtain the address and with each message, where the client did not object initially (article 12, paragraph 2).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not send commercial communications by electronic mail that hide the real identity of the person on whose behalf they are made contrary to article 5 of Law 365/2002, that give no valid address to which the recipient can send a request to stop such communications, or that encourage recipients to visit internet pages contrary to article 5 of Law 365/2002 (article 12, paragraph 3).NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Paragraphs 1 and 3 apply correspondingly to subscribers that are legal persons (article 12, paragraph 4).
These lines are LexLint's reading of the law's text, as of . Also read by: Court of Justice, judgment of , Inatais, C-654/23 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 13(2) sets a fine of RON 5,000 to RON 100,000 for these contraventions and, for a company with turnover above RON 5,000,000, a fine of up to 2 percent of turnover.
- Rule
- Higher of
- As of
- Minimum
- 5,000
- Currency
- RON
- Fixed cap
- 100,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record the contraventions and apply the sanctions (article 13(5)).
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0654
- Case citation
- Court of Justice, judgment of , Inatais, C-654/23
- Open questions
- Does the customer exception in Article 12(2) of Legea nr. 506/2004, which speaks of an 'adresa de poștă electronică', reach an SMS or an in-app message sent to a customer?
What this law does
Article 12(1) of Law 506/2004 prohibits commercial communications through automatic calling and communication systems that need no human operator, through fax or electronic mail, or through any other method that uses publicly available electronic communications services, unless the subscriber or user concerned has first given express consent to receive them.
Article 12(2) lets a person who directly obtains a client's electronic mail address when selling the client a product or service use it for commercial communications about its own similar products or services, if the client is clearly and expressly offered a simple and free way to object both when the address is obtained and with each message, where the client did not object initially.
Article 12(3) prohibits in all cases commercial communications by electronic mail that hide the real identity of the person on whose behalf they are made contrary to article 5 of Law 365/2002, that give no valid address to which the recipient can send a request to stop such communications, or that encourage recipients to visit internet pages contrary to article 5 of Law 365/2002. Article 12(4) applies paragraphs 1 and 3 correspondingly to subscribers that are legal persons.
Article 13(1)(q) makes failing to meet article 12 on unsolicited communications a contravention. Article 13(2) sanctions the contraventions in article 13(1)(a) to (l), (n), (o) and (q) with a fine of RON 5,000 to RON 100,000 and, for a company with turnover above RON 5,000,000, with a fine of up to 2 percent of turnover. Article 13(5) has the staff of the National Supervisory Authority for Personal Data Processing (ANSPDCP) record those contraventions and apply the sanctions. Emergency Ordinance 13/2012, published on , amended article 12(1).
When LexLint raises it
When your app profile says your app sends automated outreach.