Sibiu Tribunal: CNCF denied CCTV access request; court rules on immaterial damage claim

ECLI Code ECLI:RO:TBSIB:2026:001.###### R O M A N I A COURT OF ##### CIVIL DIVISION I Case No. ###/85/2026 Civil Judgment No. ###/2026 Public hearing held on #####, 2026 The Court, composed of: PRESIDING JUDGE: ##### ##### ###### Clerk: ####### ########## #### The ruling in the civil case involving the plaintiff ##### ###### ##### and the defendant REGIONAL RAILWAY BRANCH ######, A SUBDIVISION OF ######## NATIONAL RAILWAY COMPANY “CFR” SA, concerning a tort claim. It is noted that on June 26, 2026, the plaintiff ##### ###### ##### submitted written arguments to the case file via email. It is noted that this case was heard on the merits at the public hearing held on June 24, 2026, when the parties present submitted their arguments, which were recorded in the ruling issued on that date, which forms an integral part of this document, and at which time, the court, needing time to deliberate and to allow the parties to submit written briefs, pursuant to the provisions of Article 396(1) of the Code of Civil Procedure, adjourned the rendering of the judgment until today, July 3, 2026, on which date it deliberated and rendered the following judgment: THE COURT Having deliberated on the present civil case, finds as follows: By the complaint filed with the court ##### on February 5, 2026, under case no. ###/85/2026, the plaintiff ##### ###### ##### filed a lawsuit against the defendant ######## NATIONAL RAILWAY COMPANY “C.F.R.” S.A., through its ###### Regional Railway Branch, requesting that the court’s decision order the following: - that the violation of the plaintiff’s right of access to personal data be established; - that the defendant be ordered to pay moral damages in the amount of 3,500 lei, or in the amount the court deems appropriate; - that the defendant be ordered to provide complete copies of the requested data; - that the defendant be ordered to pay the court costs. In the statement of grounds, the plaintiff stated that, on May 30, 2025, he submitted a request to the defendant for access to personal data, requesting video footage and information regarding the processing of his data. The defendant failed to comply with the obligations set forth in Articles 12 and 15 of EU Regulation 679/2016, and as a result, the claimant filed a complaint with the National Supervisory Authority for the Processing of Personal Data. In its official response issued in case no. 18016/July 18, 2025, the National Supervisory Authority for the Processing of ######## (ANSPDCP) found a violation of the claimant’s right of access and issued a warning to the National Railway Company “CFR” S.A. for violating: Article 12(6) of the GDPR; Article 15(3) of the GDPR•, and Article 83(5)(b) of the GDPR. This finding confirms the existence of the unlawful act and the controller’s fault. The refusal and the unjustified delay caused him stress, uncertainty, and the inability to use the data for lawful purposes and to have evidence for other pending cases. Pursuant to Article 82 of the GDPR, any person who has suffered non-material damage is entitled to compensation. Due to the controller’s refusal and unlawful conduct: his access to his own data was restricted; he was forced to file administrative complaints and take additional steps; he suffered stress and psychological distress and was prevented from using his data in other pending cases. He requests the award of non-pecuniary damages commensurate with the severity of the violation confirmed by the ANSPDCP. In law, the claimant invoked the following legal provisions: Article 15 of the GDPR, the data subject’s right of access; Article 12 of the GDPR, the controller’s obligations; Article 82 of the GDPR, the right to compensation; Article 24 of Law No. 102/2005; Law No. 190/2018; Articles 1349 and 1357 of the Civil Code regarding civil liability in tort. In support of the claim, the plaintiff requested that documentary evidence be admitted, submitting the following (pp. 2–5): ANSPDCP Decision No. 18016/July 18, 2025; the initial request for access to data and the response received from the data controller. The complaint was legally stamped with a court stamp duty in the amount of 270 lei (p. 15). In its answer filed on March 19, 2026, the defendant requested that the complaint be dismissed and that the plaintiff be ordered to pay the court costs. In its statement of reasons, the defendant noted that, following the complaint (filed by the plaintiff) with the National Supervisory Authority for the Processing of Personal Data, the Authority issued, on July 18, 2025, via Document No. 18016, a response to the complainant, notifying him that it had decided to issue a warning to the National Company of ### ###### ### SA, without imposing any financial penalty. The defendant argues that the action is inadmissible, given that the conditions set forth in Administrative Litigation Law No. 554/2004 regarding the completion of the preliminary procedure have not been met. According to the defendant, specifically Article 7 of Law No. 554/2004, a person who considers that an administrative act or an unjustified refusal to resolve a request has infringed upon a right or a legitimate interest is required to first address the issuing public authority by filing a preliminary complaint before bringing the matter before the competent court. This preliminary procedure is a mandatory prerequisite for bringing the action. Failure to follow this procedure renders the action filed directly with the court premature and inadmissible, as the law expressly establishes this step as a condition for the admissibility of the claim. An analysis of the complaint reveals that the plaintiff has not demonstrated that the preliminary procedure was followed in accordance with the law, namely, the filing of a complaint addressed to the defendant. Under these circumstances, bringing the matter directly before the court without first completing the preliminary procedure required by law results in the action being dismissed as inadmissible. Furthermore, the defendant raised the defense of lack of proof of damage. The plaintiff asserts that this situation caused him non-pecuniary damages, seeking the sum of 3,500 lei; however, he fails to prove the existence of actual and effective non-pecuniary damages, an essential condition for establishing civil tort liability. Pursuant to Article 1357(1) of the Civil Code, “anyone who causes harm to another through a wrongful act committed with fault is obligated to compensate for it,” and according to Article 1349, paragraphs 1–3, of the Civil Code: (1) “Every person has the duty to comply with the rules of conduct imposed by law or local custom and not to infringe, through their actions or inactions, upon the rights or legitimate interests of other persons.” Thus, for the defendant to be held liable in tort, the following conditions must be met cumulatively: the existence of damage; a tortious act causing damage; a causal link between the tortious act and the damage, as well as the fault of the party causing the damage. Even though the legislature provides that any damage is subject to compensation (Art. 1381, para. I of the new Civil Code), compensation may be awarded only when the prescribed conditions are met. Thus, to be compensable, the damage must be: certain—the damage is certain when its current or future existence is beyond doubt and, at the same time, its extent can be determined at present, that is, the damage is already present immediately after the occurrence of the tortious act that caused it. In other words, the certainty of the damage also refers to its actual nature—that is, it is real and present, as opposed to putative or merely contingent; direct—that is, the unjust damage caused is a direct consequence of the tortious act; personal nature—only the person or persons who have suffered the unjust damage are entitled to claim compensation for it; arising from the violation of a right or a legitimate interest—the damage is compensable if it results from the violation of subjective property or non-property rights. The defendant argued that the plaintiff failed to prove the existence of actual and real non-pecuniary damages, limiting himself to general assertions regarding his stress, uncertainty, and discomfort. However, the mere assertion of a state of stress is not sufficient to warrant the award of damages. With regard to the compensation regime in the area of personal data protection, Article 82(1) of EU Regulation ######## of the ######## Parliament and of the Council on the protection of natural persons with regard to the processing of personal data provides: “Any person who has suffered material or non-material damage as a result of an infringement of this Regulation is entitled to compensation.” It follows from the interpretation of the text that a mere violation of the Regulation does not automatically give rise to a right to compensation; proof of the existence of damage is required. This interpretation is also confirmed by the Court of Justice of the European Union in the relevant case concerning ######## Poștală ######### Osterreichische ####, which held that a mere violation of the GDPR is not sufficient to grant compensation: the data subject must prove the existence of actual harm, and there must also be a causal link. The stress or discomfort alleged are mere assertions by the plaintiff, unsubstantiated in any way. In the complaint, the plaintiff generically alleges the existence of stress, uncertainty, and psychological distress, without, however, presenting any evidence to support this. #### It is also well established that the stress inherent in a dispute or administrative proceeding cannot be classified as compensable non-pecuniary damage. As can be seen, the plaintiff does not submit medical documents, evidence regarding the impact on his personal or professional life, or other objective evidence demonstrating the existence of actual suffering, but limits himself to mere assertions (subjective claims), which are insufficient to establish civil tort liability. On the merits of the case: In the complaint, the plaintiff ##### ###### ##### makes a series of statements regarding his identity, stating, among other things, that he is “from the lineage of #####, son of #####, son of #####,” that he was “born alive,” etc. These statements are legally irrelevant to the subject matter of this dispute, which concerns exclusively the exercise of the right of access to data, pursuant to EU Regulation ######## of the ######## Parliament and of the Council on the protection of natural persons with regard to the processing of personal data. These are not elements capable of establishing the person’s identity in relation to the data controller, nor can they compensate for the lack of specific identifying data. In other words, although the court has no reason to doubt that the claimant “was born alive, and that this event was recorded in the civil registry,” these circumstances cannot substitute for the information necessary to identify a person in the context of a request for access to personal data. However, in the context of exercising the rights provided for in EU Regulation ######## of the European Parliament ######## and of the Council on the protection of natural persons with regard to the processing of personal data, the controller is required to verify the identity of the person requesting access to the data, and concrete identifying details—such as those typically found in identification documents—are necessary to carry out this verification. #####, it is easy to see that the claimant provides extensive details about the circumstances of his own birth, yet omits precisely the information that would have allowed him to be identified by the data controller. Pursuant to Article 194 of the Code of Civil Procedure, the complaint shall include: a) the first and last names, domicile, or residence of the parties or, for legal entities, their name and registered office. Furthermore, the complaint shall also include the claimant’s personal identification number or, as the case may be, unique registration code or tax identification number, the number of registration in the commercial register or entry in the register of legal entities, and the claimant’s bank account, as well as those of the defendant, if the parties possess or have been assigned these identification details in accordance with the law, to the extent that they are known to the plaintiff. #### If the plaintiff resides abroad, the plaintiff shall also indicate the chosen domicile in ####### where all communications regarding the proceedings are to be sent; b) the first and last name and capacity of the person representing the party in the proceedings, and in the case of representation by an attorney, the attorney’s first and last name and office address. The provisions of Article 148(1), second sentence, apply accordingly. Proof of the representative’s status, in the form provided for in Article 151, shall be attached to the complaint. These elements are provided for by law precisely to allow for the certain identification of the parties to the proceedings. Failure to include the CNP in the complaint, or at least the series and number of the identity card, is a recurring issue; the same situation existed in the initial request for access to data, addressed to “CFR Călători #####” on June 5, 2025. The CNP is an essential element for identifying an individual, used in any official document, and all the more so in a complaint. This omission is all the more relevant given that the subject matter of this dispute is the exercise of the right of access to data, pursuant to Regulation IJF. 2016/679 of the ######## Parliament and of the Council on the protection of natural persons with regard to the processing of personal data. On June 5, 2025, the plaintiff ##### ###### sent an email to the National ######## of ### ###### ### SA — ### Service. CA and ####-#####, a request seeking “access to and disclosure of the video recording from May 30, 2025, between 6:08 p.m. and 6:30 p.m. ..recorded by the surveillance camera located in front of ##### #####.” As already mentioned, the complainant submitted the request without providing proof of identification. In letter No. ############.06.2025, the ###### Regional Railway Branch informed the petitioner ##### ###### ##### that the request could not be granted, since the video recording contains images of identifiable individuals, and that providing a copy of the video would infringe upon the rights and freedoms of the individuals appearing in the recording, in accordance with Article 15(3) and (4) of EU Regulation ######## of the ######## Parliament and of the Council. Therefore, the ###### Regional Railway Branch proceeded to review and evaluate the request, fully complying with internal procedures, and provided a response to the petitioner within the statutory time limit. Subsequently, the complainant filed a complaint with the National Supervisory Authority for the Processing of ######## Personal Data, which issued an administrative warning to the undersigned, without imposing any financial penalties and without establishing the existence of moral or material damage. It emphasizes that this warning does not constitute a finding of guilt or any tortious liability. The claimant’s interpretation that the decision of the National Supervisory Authority for the Processing of ######## Personal Data automatically amounts to confirmation of the existence of an unlawful act and the controller’s fault is unfounded, since civil liability requires the existence of an unlawful act, actual damage, and a causal link between the unlawful act and the damage, which is not the case here. In fact, the data controller acted promptly and correctly, thereby eliminating any potential subsequent harm. Regarding the claim in which the plaintiff requests that “the defendant be ordered to provide complete copies of the requested data,” the defendant states that this request is unfounded and, moreover, impossible to fulfill. The recordings made by the surveillance cameras at the ##### station on May 30, 2025, were automatically deleted by the video surveillance system after a period of 30 days, in accordance with applicable regulations, namely Law ######## on the security of facilities, property, valuables, and the protection of persons. Therefore, any request to provide older data or additional copies that no longer exist in the records is impossible to fulfill and cannot be enforced by a court order. Consequently, the plaintiff’s request for the full provision of copies of the data must also be dismissed as unfounded. In law, the defendant has based this answer on the provisions of Articles 201, 205, and 206 of the Code of Civil Procedure, as well as on all legal provisions mentioned herein. As evidence, the defendant requested that documentary evidence be admitted, in connection with which it submitted: a request to CFR Călători ##### issued on June 5, 2025, by the plaintiff; a request to CFR Călători dated June 10, 2025; document No. ############.06.2025 issued by ####### Facilities of the undersigned. In the response to the defense filed on April 6, 2026, the plaintiff requested that the defendant’s objections be dismissed, arguing that his action is not an administrative dispute requiring the completion of a preliminary procedure. He specified that his harm consists of the frustration and sense of helplessness resulting from the unjustified refusal, the loss of time and effort expended in filing complaints and lawsuits, and the inability to use the images in other pending cases, which concern, among other things, his interaction with police officers and the abuse of power and violence to which he was subjected. He further argued that, although the defendant claims the recordings were deleted, this does not justify the initial unlawful refusal. At the hearing on April 29, 2026, the court dismissed the motion to dismiss as unfounded and reclassified the motion regarding the lack of evidence of harm as a defense on the merits. During the judicial proceedings, documentary evidence was presented by both parties, and the plaintiff also presented testimonial evidence from the witness ####### ####, whose testimony was attached on page 77. Having reviewed the documents and proceedings in the case file, the court finds the following: In fact, on June 5, 2025, the plaintiff filed a request with the defendant (pp. 2–3), pursuant to the provisions of Article 15 of Regulation (EU) 2016/679 and Law No. 544/2001 on access to information of public interest, requesting that a copy of the video recording from May 30, 2025, between 6:08 p.m. and 6:30 p.m., captured by the surveillance camera located in front of ##### ##### – 1 Decembrie 1918 Street, which covers the public space in front of the train station, where the complainant alleges that an interaction took place between him and officers of the ###### Police. In its response dated June 24, 2023 (p. 5), the defendant informed the complainant that, following an analysis of his request, the request could not be granted, as providing a copy of the video recording would violate the personal data protection rights of the other individuals appearing in the recording. In a petition filed with the National Supervisory Authority for the Processing of Personal Data under No. 18016 on July 18, 2025, the complainant ##### ###### ##### reported that the ###### Regional Railway Branch—a subdivision of the National Railway Company “CFR” SA— had violated his right of access by refusing to provide him with the recordings from a video surveillance camera installed in front of ##### ##### on May 30, 2025, between ###08####30. By means of the report of findings/sanction No. 33795/December 16, 2025 (pp. 62–68), the defendant was issued a warning pursuant to Article 58(2)(b) of the GDPR, in conjunction with Article 14(11) and Article 15( (1) of Law No. 102/2005, as well as Article 12 of Law No. 190/2018 in conjunction with Article 7 of Government Ordinance No. 2/2001, in relation to Article 83 (5)(b), for the violation of Article 12(6) and Article 15(3) of the GDPR. The following corrective measures were ordered, pursuant to Article 58( (2)(c) and (d) of Regulation (EU) No. 679/2016: the release of a copy of the video recordings requested by Mr. ##### ###### ##### in the request filed under No. 1/6/P/990/06.06.2025, in compliance with the provisions of Article 15(3) and (4) of the GDPR, taking into account the Guidelines of the ######## for Data Protection No. 3/2019 on the processing of personal data via video surveillance, to the extent that these images are still available and following confirmation of the applicant’s identity—within 5 business days from the date of communication of these minutes; adopting internal procedures or revising existing internal procedures regarding the handling of requests submitted by data subjects under the GDPR (Articles 12–22), compliance in all cases with the applicable provisions regarding the prompt review and resolution of such requests and the provision of responses to data subjects within the statutory time limits, as well as the regular training of the controller’s staff in this regard — 30 business days from the date of communication of these minutes. Based on the facts of the case, it was found that the defendant, “####### National Railway Company ‘CFR’ SA,” failed to properly handle and resolve the request submitted by Mr. ##### ###### ##### registered under No. 1/6/P/990/06.06.2025, in which he requested a copy of the footage recorded by the video surveillance camera installed in front of ##### ##### on May 30,2025, between ###08 and 18:30, in accordance with the provisions of Article 12(6) and Article 15(3) of Regulation (EU) No. 679/2016. This act constitutes an administrative offense under Article 12 of Law No. 190/2018, in accordance with the provisions listed in Article 83(5)(b) of the GDPR.” In law, pursuant to Article 72 of the Civil Code, every person has the right to respect for their dignity. (2) #### Any infringement upon a person’s honor and reputation is prohibited without their consent or without observing the limits set forth in Article 75. According to Article 252 of the Civil Code, every natural person has the right to the protection of the intrinsic values of the human being, such as life, health, physical and mental integrity, dignity, privacy, freedom of conscience, and scientific, artistic, literary, or technical creation. Furthermore, the provisions of Article 1357 of the Civil Code apply in this case, according to which a person who causes harm to another through a tortious act, committed intentionally or through negligence, is obligated to provide compensation. The person causing the harm is liable for even the slightest degree of fault. Thus, in order to establish a person’s civil liability in tort, the following conditions must be cumulatively met: there must be harm, there must be an unlawful act, there must be a causal link between the unlawful act and the harm, and the perpetrator of the unlawful and harmful act must be at fault. Upon analyzing the conditions for civil tort liability, the court finds that the condition of an unlawful act is met, which consists of the violation of the plaintiff’s right of access to personal data, the act being indisputably proven by the report of findings/sanctions No. 33795/12/16/2025. With regard to damages, these consist of the financial and non-pecuniary harm suffered by a person as a result of the violation of their subjective rights and legitimate interests through the commission of a tortious act by another person. Pursuant to the provisions of Article 1381, paragraphs (1) and (2), and Article 1385 of the Civil Code, any damage entitles the victim to compensation, a right that arises on the day the damage is caused. Furthermore, the damage must be certain both as to its existence and its assessment, and must not yet have been remedied. Damages are compensated in full, and their assessment shall take into account the date on which the damage occurred, as provided for in Article 1385(1) and Article 1386(2) of the Civil Code. Non-pecuniary damages consist of the direct harmful consequence of an unlawful and culpable act, which infringes upon the non-pecuniary values that define human personality. With regard to the amount claimed as non-pecuniary damages, the court finds that it is difficult to quantify, a difficulty stemming, above all, from the impossibility of viewing it as a “pretium dolores,” that is, as compensation for the suffering endured by the plaintiff. However, in determining the amount of compensation equivalent to non-pecuniary damages, the court must take into account a number of criteria, such as the negative physical and psychological consequences suffered by the claimant, the significance of the moral values that have been violated, the extent to which they have been violated, the intensity with which the consequences were, are, and especially will be perceived, and the extent to which the party has been affected emotionally and within their family. At the same time, the court must strike a balance between the non-pecuniary damage suffered and the compensation awarded, such that the injured party receives certain benefits to alleviate their non-pecuniary suffering, without, however, resulting in unjust enrichment. The principle emerging from the case law of the European Court of Human Rights regarding non-pecuniary damages—which national courts are required to apply—is that of determining the compensation awarded to the victim in equity, in light of the particular circumstances of each individual case. Furthermore, according to the same case law, the compensation awarded must maintain a reasonable proportionality with the harm suffered, in accordance with the established principle that the compensation awarded must be proportionate to the harm suffered. #### The monetary amount awarded as compensation for non-pecuniary damages must not become a source of enrichment for the victim, nor should it be purely symbolic; rather, it must represent only as much as is necessary to alleviate or compensate, to the extent possible, the suffering the victim has endured or may still have to endure. Since monetary compensation for non-pecuniary harm is, by its very purpose—that of alleviating the injured party’s situation and providing them with satisfaction—a legal category of a special nature, it must be the result of a careful analysis of the specific circumstances of the case (the intensity and duration of the psychological suffering experienced by the injured third party, determined by the severity of the harm suffered in the context of their specific situation), that is, based on objective elements that preclude the possibility that the monetary compensation awarded could constitute an immoral means of enriching the victim. With regard to the non-pecuniary damages suffered by the plaintiff and assessed at 3,500 lei, the court finds that this is determined by assessment, based on the application of criteria regarding the negative consequences suffered by the claimant—both physically and psychologically—the significance of the values infringed upon, and the intensity with which the consequences of the injury were perceived. The court finds that, both through the testimonial evidence presented and the documents submitted to the case file, the plaintiff has demonstrated psychological suffering, consisting of feelings of frustration, stress, injustice, and helplessness, having been forced to take multiple steps to obtain a right conferred and recognized by law, thereby establishing the causal link between the tortious act and the damage. At the same time, in quantifying the damages, the court will take into account that, although the penalty notice established the defendant’s obligation to make the video recording available to the plaintiff, the defendant failed to do so, as that obligation is currently impossible to fulfill, given that the defendant claims it is no longer in possession of the recording. Consequently, the violation of the plaintiff’s right can now be remedied only through the damages to be awarded. However, the court finds that the amount requested is disproportionate. There is no doubt regarding the negative psychological consequences suffered by the plaintiff or the significance of the harm caused; however, at the same time, it must be taken into account that the existence of a serious and prolonged psychological imbalance has not been proven. Taking into account the need for the awarded non-pecuniary damages to provide compensation for the moral harm suffered by the victim, as well as the need to ensure proportionality between the harm and the compensation, the court sets the amount of non-pecuniary damages at 1,000 lei, finding that this amount meets the requirements set forth above. Consequently, the court will grant the first two claims, find that the plaintiff’s right of access to personal data was violated, and order the defendant to pay the plaintiff the sum of 1,000 lei as non-pecuniary damages. With regard to claim No. 3, the court will dismiss it as moot, given that the defendant no longer possesses the video recordings from May 30, 2026, as they were automatically deleted by the video surveillance system after a period of 30 days, in accordance with the regulations in force, namely Law ######## on the security of facilities, property, valuables, and the protection of persons. Since the defendant has lost the case, the court, pursuant to Art. 453, para. (1) of the Code of Civil Procedure, will order it to pay the plaintiff the sum of 75 lei, representing court costs, namely the court filing fee corresponding to the claims that were upheld. FOR THESE REASONS, IN THE NAME OF THE LAW IT IS HEREBY ORDERED To partially grant the civil action filed by the plaintiff ##### ##### ######, residing in ##### - Şelimbăr, #### ###### ####### ### #, ### ##, ##### County, against the defendant ######## NATIONAL RAILWAY COMPANY “C.F.R.” S.A., through its ###### Regional Railway Branch, with its registered office at #### ######, town of ######, #### ############ ### #. that the defendant violated the plaintiff’s right of access to personal data. Orders the defendant to pay the plaintiff the sum of 1,000 lei as compensation for non-pecuniary damages. Dismisses the claim seeking to compel the defendant to provide the video recording, as it has become moot. Orders the defendant to pay the plaintiff the sum of 75 lei, representing court costs. The judgment is subject to appeal within 30 days of service. The appeal must be filed with the ##### Court, under penalty of nullity. Rendered today, July 3, 2026, by making the decision available to the parties through the court clerk’s office. Presiding Judge, Court Clerk, ###### ##### ##### #### ####### ########## Ed. #####/July 3, 2026 Tech. Ed. #####/July 3, 2026