Export
Fine against HAYAT MEDICAL and DENTAL S.R.L
As part of its dental care activities, Hayat Medical & Dental SRL (the controller) processed patients’ names and phone numbers, which were subsequently accessed and disclosed.
StatusNot cited by any decision here yet
Holding
Regarding the controller’s cooperation with the DPA, the DPA held that the controller failed to provide all the information requested in the exercise of its investigative powers, in breach of Article 58(1)(a) GDPR and Article 58(1)(e) GDPR, in conjunction with Article 83(5)(e) GDPR. Regarding the processing of patients’ personal data, the DPA found that the controller processed the data without a legal basis, including by accessing and disclosing patients’ names and phone numbers. The DPA therefore found a violation of Article 5(1)(a) GDPR and Article 6(1) GDPR. In this context, the DPA decided to fine the controller €2,000 (RON 10,700) for failing to provide the requested information and €3,000 (RON 16,050) for unlawfully processing patients’ personal data.
From GDPRhub’s case note — a summary of the decision, not its own words.Read it in the text ↓
Full text
Machine translation of the decision, via GDPRhub — not the official text.Read the original
October 28, 2026 Fines for GDPR Violations The National Supervisory Authority for Personal Data Processing completed, in October 2026, an investigation into the data controller S.C. HAYAT MEDICAL & DENTAL S.R.L. and found a violation of the provisions of Article 83(5)(e) in conjunction with Article 58( (1)(a) and (e), Article 5(1)(a), and Article 6(1) of Regulation (EU) 2016/679. Accordingly, the controller was assessed an administrative fine of: 10,700 lei (equivalent to 2,000 euros) for violating the provisions of Article 83( (5)(e) in conjunction with Article 58(1)(a) and (e) of the EU Regulation. a fine of 16,050 lei (equivalent to 3,000 euros) for violating the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU). The investigation was initiated following a complaint submitted by a data subject, who alleged a possible violation of the provisions of Regulation (EU) 2016/679. The investigation revealed that the controller failed to provide all the necessary information requested by the National Supervisory Authority in the exercise of its investigative powers established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 83(5)(e) in conjunction with Article 58(1)(a) and (e) of Regulation (EU) 2016/679. Furthermore, it was found that the controller processed the personal data of certain patients without a legal basis and without complying with the principle of “lawfulness, fairness, and transparency” established by Regulation (EU) 2016/679, which constitutes a violation of the provisions of Article 5(1)(a) and Article 6(1) of Regulation (EU) No. 679/2016. Thus, personal data consisting of first names, last names, and telephone numbers were accessed and disclosed. The National Supervisory Authority determined that the circumstances of the aforementioned case are sufficiently serious to warrant the imposition of a fine against the controller, in accordance with the criteria for determining the amount of fines set forth in Article 83 of Regulation (EU) No. 679/2016. Legal and Communications Division A.N.S.P.D.C.P.