On the 16th of December 2019, The National Supervisory Authority finalised an investigation to a SC Enel Energie S.A., ascertaining the following:

the infringement of provisions of Article 5 paragraph (1) letter d) and paragraph (2) of General Data Protection Regulation;
the infringement of provisions of Articles 6 and 7 of General Data Protection Regulation;
the infringement of provisions of Article 21 paragraph (1) of General Data Protection Regulation.

The controller S.C. Enel Energie S.A. was sanctioned with two fines, each amounting to 14,334.30 lei, the equivalent of 3000 euros for the violation of Article 5 paragraph (1) letter d), Article 6 paragraph (1) letter a) and Article 7 paragraph (1) of the General Data Protection Regulation, respectively for the violation of the provisions of Article 21 paragraph (1) of the General Data Protection Regulation.

The sanctions were imposed following a complaint alleging that S.C Enel Energie S.A. illegally processed the data of the petitioner, unable to prove his/her consent for sending notifications to this e-mail address and without respecting the principle of accuracy. In addition, the controller did not take the necessary measures to disable the transmission of notifications, although the petitioner exercised his/her right to object on several occasions.

The controller paid the fine.

A.N.S.P.D.C.P.