overview.legal
More
TopicsLawsCase lawEnforcementGuidanceNews

More sources

Literature Academic articles and books Tools Templates, checklists, calculators

Overviews

This week Everything added in the last 7 days Enforcement dashboard Fines by country, authority and article Coverage What the collection holds, and how current

Work with it

Transit Your processing register as a metro map API & AI tools REST, MCP server, context files Alerts & account Follow topics, get digests
About overview.legal Classic layout
Enforcement · ANSPDCP (Romania)

Fine against HAYAT MEDICAL and DENTAL S.R.L

Fine against HAYAT MEDICAL and DENTAL S.R.Lgdprhub.eu ↗

Export

Holding

Regarding the controller’s cooperation with the DPA, the DPA held that the controller failed to provide all the information requested in the exercise of its investigative powers, in breach of Article 58(1)(a) GDPR and Article 58(1)(e) GDPR, in conjunction with Article 83(5)(e) GDPR. Regarding the processing of patients’ personal data, the DPA found that the controller processed the data without a legal basis, including by accessing and disclosing patients’ names and phone numbers. The DPA therefore found a violation of Article 5(1)(a) GDPR and Article 6(1) GDPR. In this context, the DPA decided to fine the controller €2,000 (RON 10,700) for failing to provide the requested information and €3,000 (RON 16,050) for unlawfully processing patients’ personal data.

From GDPRhub’s case note — a summary of the decision, not its own words.

Full text

October 28, 2026 Fines for GDPR Violations The National Supervisory Authority for Personal Data Processing completed, in October 2026, an investigation into the data controller S.C. HAYAT MEDICAL & DENTAL S.R.L. and found a violation of the provisions of Article 83(5)(e) in conjunction with Article 58( (1)(a) and (e), Article 5(1)(a), and Article 6(1) of Regulation (EU) 2016/679. Accordingly, the controller was assessed an administrative fine of: 10,700 lei (equivalent to 2,000 euros) for violating the provisions of Article 83( (5)(e) in conjunction with Article 58(1)(a) and (e) of the EU Regulation. a fine of 16,050 lei (equivalent to 3,000 euros) for violating the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU). The investigation was initiated following a complaint submitted by a data subject, who alleged a possible violation of the provisions of Regulation (EU) 2016/679. The investigation revealed that the controller failed to provide all the necessary information requested by the National Supervisory Authority in the exercise of its investigative powers established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 83(5)(e) in conjunction with Article 58(1)(a) and (e) of Regulation (EU) 2016/679. Furthermore, it was found that the controller processed the personal data of certain patients without a legal basis and without complying with the principle of “lawfulness, fairness, and transparency” established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU) No. 679/2016. Thus, personal data consisting of first names, last names, and telephone numbers were accessed and disclosed. The National Supervisory Authority determined that the circumstances of the aforementioned case are sufficiently serious to warrant the imposition of a fine against the controller, in accordance with the criteria for determining the amount of fines set forth in Article 83 of Regulation (EU) No. 679/2016. Legal and Communications Division A.N.S.P.D.C.P.