News
EN

ANSPDCP (Romania) - Fine against Ascendex Technology SRL

GDPRhub
Personal Data Controllers Competent Authorities Designation and Powers under DSA Supervisory Authorities Supervision
Jul 9, 2026 Source

Content

The DPA fined a cryptocurrency exchange platform RON 57,839 (€11,000) for failing to properly and timely handle data subjects’ erasure requests in a cross-border processing case. English Summary. Facts. The Romanian DPA (ANSPDCP) launched an investigation into the cryptocurrency exchange platform Ascendex Technology SRL (the controller). The DPA was notified by the French DPA (CNIL) regarding a complaint filed by a data subject in France against the controller. Since the controller’s sole establishment was in Romania and its processing substantially affected data subjects in multiple Member States, which constituted cross-border processing under Article 4(23)(b) GDPR, the Romanian DPA accepted its role as the lead supervisory authority. During the investigation, the DPA found that the controller handled the data subject’s erasure request only after approximately 12 months. It noted that the controller did not provide a final response regarding the fulfilment of the request nor justifie

Related across sources

Guidance Guidelines 04/2022 on the calculation of administrative fines under the GDPR EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Enforcement Tensa Art Design S.A: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

Similar Content