# ANSPDCP (Romania) - Fine against HAYAT MEDICAL and DENTAL S.R.L - Type: Enforcement - Source: ANSPDCP (Romania) - Date: 2026-11-04 - Original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_HAYAT_MEDICAL_and_DENTAL_S.R.L - Canonical: https://overview.legal/posts/607572 - Topics: Personal Data, Controllers, Fairness & Transparency, Supervision, Fines, Supervisory Authorities, Processing, Transparency, Healthcare ## Summary Facts — As part of its dental care activities, Hayat Medical & Dental SRL (the controller) processed patients’ names and phone numbers, which were subsequently accessed and disclosed. Following a complaint lodged by a data subject, the Romanian DPA launched an investigation, during which the controller failed to provide all the information requested by the authority. Holding — Regarding the controller’s cooperation with the DPA, the DPA held that the controller failed to provide all the information requested in the exercise of its investigative powers, in breach of Article 58(1)(a) GDPR and Article 58(1)(e) GDPR, in conjunction with Article 83(5)(e) GDPR. Regarding the processing of patients’ personal data, the DPA found that the controller processed the data without a legal basis, including by accessing and disclosing patients’ names and phone numbers. The DPA therefore found a violation of Article 5(1)(a) GDPR and Article 6(1) GDPR. In this context, the DPA decided to fine the controller €2,000 (RON 10,700) for failing to provide the requested information and €3,000 (RON 16,050) for unlawfully processing patients’ personal data. ## Full text October 28, 2026 Fines for GDPR Violations The National Supervisory Authority for Personal Data Processing completed, in October 2026, an investigation into the data controller S.C. HAYAT MEDICAL & DENTAL S.R.L. and found a violation of the provisions of Article 83(5)(e) in conjunction with Article 58( (1)(a) and (e), Article 5(1)(a), and Article 6(1) of Regulation (EU) 2016/679. Accordingly, the controller was assessed an administrative fine of: 10,700 lei (equivalent to 2,000 euros) for violating the provisions of Article 83( (5)(e) in conjunction with Article 58(1)(a) and (e) of the EU Regulation. a fine of 16,050 lei (equivalent to 3,000 euros) for violating the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU). The investigation was initiated following a complaint submitted by a data subject, who alleged a possible violation of the provisions of Regulation (EU) 2016/679. The investigation revealed that the controller failed to provide all the necessary information requested by the National Supervisory Authority in the exercise of its investigative powers established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 83(5)(e) in conjunction with Article 58(1)(a) and (e) of Regulation (EU) 2016/679. Furthermore, it was found that the controller processed the personal data of certain patients without a legal basis and without complying with the principle of “lawfulness, fairness, and transparency” established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU) No. 679/2016. Thus, personal data consisting of first names, last names, and telephone numbers were accessed and disclosed. The National Supervisory Authority determined that the circumstances of the aforementioned case are sufficiently serious to warrant the imposition of a fine against the controller, in accordance with the criteria for determining the amount of fines set forth in Article 83 of Regulation (EU) No. 679/2016. Legal and Communications Division A.N.S.P.D.C.P. ## Cited law provisions (10) ### GDPR — gdpr-art-5-par-1-pnt-a-en processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); ### GDPR — gdpr-art-6-par-1-en Processing shall be lawful only if and to the extent that at least one of the following applies: ### GDPR — gdpr-art-58-par-1-en Each supervisory authority shall have all of the following investigative powers: ### GDPR — gdpr-art-58-par-1-pnt-a-en to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks; ### GDPR — gdpr-art-58-par-1-pnt-e-en to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks; ### GDPR — gdpr-art-83-par-5-pnt-e-en non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines --- Generated by overview.legal · https://overview.legal/posts/607572 · 2026-11-14