The National Supervisory Authority finalised in March current year an investigation at the controller Tensa Art Design SRL and found the breach of the provisions of Article 21 paragraph 3 from General Data Protection Regulation GDPR.

Therefore, the company Tensa Art Design SRL was sanctioned with two fines in total amount of Lei 14,755.5, the equivalent of Eur 3,000.

The sanctions were applied following some complaints through which it was reported that the claimants received commercial messages on the telephone number, respectively on the e-mail address, although they have expressed their option to not be contacted under this manner.

During the performance of the investigation the National Supervisory Authority found that the controller Tensa Art SA did not toake into consideration the objection of the claimants to the receipt of commercial messages by e-mail or sms and processed their personal data for direct marketing purposes, thus breaching the provisions of Article 21 paragraph 3 from the GDPR.

In this context, we remind that under Chapter III of Regulation EU 2016/679 the rights of the data subject are provided: the right to rectification, right to information, right of access, right to erasure (the right to be forgotten), the right to the restriction of the processing, the right to data portability, the right to object, the right not to be subject to a decision based exclusively on the automated processing, the right to submit a complaint to the supervisory authority.

Thus, under article 21 paragraph 3 it is provided that: in case the data subject object to the processing for direct marketing purpose, the personal data are no longer processed for this purpose.

Also, the corrective measure to adopt adequate and efficient internal procedures for the protection of personal data in relation to the handling of the requests submitted by the data subjects based on the GDPR (articles 12-22), to observe in all cases the provisions applicable in relation to the analysis and handling without delay of these requests, so that the controller be sure that he effectively handles the requests through which the data subjects' rights provided under Regulation EU 206/679 are provided, as well as to regularly instruct the controller's personnel in this respect were ordered.

Legal and Communication Department

A.N.S.P.D.C.P.