# ANSPDCP (Romania) - Spitalul Veterinar Tineretului SRL - Type: Enforcement - Source: ANSPDCP (Romania) - Date: 2026-10-09 - Original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Spitalul_Veterinar_Tineretului_SRL - Canonical: https://overview.legal/posts/593308 - Topics: Personal Data, Right of Access, Controllers, Supervisory Authorities, Video Surveillance, Right of Access Procedures ## Summary Facts — A data subject filed an access request with the veterinary clinic Spitalul Veterinar Tineretului SRL (controller) concerning copies of a telephone conversation and video recordings from within the controller’s premises covering a time period that the data subject was on the premises. The data subject was dissatisfied with the way the controller handled their request and lodged a complaint with the DPA. Holding — The DPA found a violation of Article 15(1) GDPR and Article 15(3) GDPR and issued a fine of RON 5,242 (€1,000). Moreover, the DPA ordered the controller to give the data subject access to the requested copies as provided for in Article 15(3) GDPR, to the extent that they are still available, and to revisit their practice on how to handle access requests, including ensuring an effective response to the requests of data subjects pursuant to Article 12 GDPR – Article 22 GDPR, and providing all requested information. Moreover, the controller was ordered to regularly train their staff in this regard. ## Full text October 7, 2026 Penalty for GDPR Violation The National Supervisory Authority for Personal Data Processing has concluded an investigation into the data controller Spitalul Veterinar Tineretului SRL and found a violation of the provisions of Article 15, paragraphs (1) and (3) of Regulation (EU) 2016/679. Accordingly, the data controller was fined 5,242 lei (equivalent to 1,000 euros). The investigation was initiated following a complaint filed by an individual who was dissatisfied with how Spitalul Veterinar Tineretului SRL handled their request for access to personal data. During the investigation, the National Supervisory Authority for Personal Data Processing found that the data controller had not properly addressed the data subject’s request for a copy of a telephone conversation with a hospital employee, as well as video recordings from within Spitalul Veterinar Tineretului SRL, covering a specified time period in which the data subject also appeared. At the same time, the following corrective measures were ordered against the controller: - providing a complete response to the petitioner, in accordance with her request, including providing a copy of the telephone conversation she had on the specified date and during the specified time period, and issuing a copy of the requested video recordings, in compliance with the provisions of Article 15( (3) of Regulation (EU) 2016/679, taking into account the European Data Protection Board’s Guidelines No. 3/2019 on the processing of personal data by video means, to the extent that such footage is still available; - adopting internal procedures or revising existing internal procedures regarding how to address requests submitted by data subjects pursuant to Regulation (EU) 2016/679 (Articles 12–22), ensuring compliance in all cases with the applicable provisions regarding the prompt review and resolution of such requests, so that the controller ensures that it effectively responds to requests from data subjects, including by providing all requested information, as well as by regularly training the controller’s staff in this regard. Legal and Communications Department A.N.S.P.D.C.P. ## Cited law provisions (5) ### GDPR — gdpr-art-15-par-1-en The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: ### GDPR — gdpr-art-15-par-3-en The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. ### GDPR — gdpr-art-12-en Transparent information, communication and modalities for the exercise of the rights of the data subject ### GDPR — gdpr-art-15-en Right of access by the data subject ### GDPR — gdpr-art-22-en Automated individual decision-making, including profiling --- Generated by overview.legal · https://overview.legal/posts/593308 · 2026-10-09