RomaniaANSPDCP Enforcement and GDPR Article 82
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Compensate any person in Romania who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)'s top-tier ceiling. Legea nr. 190/2018's own Chapter VI (Articles 12-14) sets no separate Romanian figure: Article 12(3) expressly sanctions violations of the law's own national-specific provisions (Articles 3-9, e.g. national identification number processing) under the conditions of GDPR Article 83(5), channeling them into this same ceiling rather than a reduced national cap. For public authorities and bodies, Articles 13-14 add a mandatory first step of a warning and remediation plan before ANSPDCP may apply a fine at all, and Article 14 then sets national fine ranges instead: RON 10,000 to 100,000 for the controller, processor, certification-body and monitoring-body duties it lists and for Articles 3 to 9 of the Act, and RON 10,000 to 200,000 for the infringements listed in Article 14(5) and for breach of an ANSPDCP decision.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP, National Supervisory Authority for Personal Data Processing)
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Romanian rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 gives a person who suffered damage a right to compensation, and Law 190/2018 Articles 12 to 14 set warnings, fines and a remediation plan for public bodies. None of them states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP, National Supervisory Authority for Personal Data Processing) is Romania's supervisory authority. Law 190/2018 makes an infringement of the General Data Protection Regulation (GDPR) provisions listed in Article 83(4) to (6) a contravention, sanctioned by a warning or a fine. A public authority or body first receives a warning with a remediation plan. ANSPDCP may then fine it if the plan is not carried out in full.
For a public authority or body, Article 14 sets its own fine range of RON 10,000 to 100,000, or RON 10,000 to 200,000 for the infringements it lists in paragraph 5 and for breach of an ANSPDCP decision. GDPR Article 82 arms an individual with a direct private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .