ROMÂNIA
AUTORITATEA NAȚIONALĂ DE SUPRAVEGHERE
A PRELUCRĂRII DATELOR CU CARACTER PERSONAL
Bld. Gen. Gheorghe Magheru Nr. 28-30, Sector 1, Cod poștal 010336, București; Tel. +40.31.805.9211; Fax:+40.31.805.9602 www.dataprotection.ro e-mail: [email protected]
# Decision
# Following the investigation performed at Dante International SA
The National Supervisory Authority for Personal Data Processing, with its headquarters in 28-30 Gen. Gheorghe Magheru Blvd., District 1, Postal code 010336, Bucharest, legally represented through [REDACTED], President, issues this decision against Dante International SA, with its headquarters in 148 Virtutii Road, Bucharest, District 6, Sole registration code: 14399840, registered with the Trade Registry under no. J40/372/2002, legally represented by [REDACTED], as director and [REDACTED], data protection officer.
Considering the following:
# I. Background
# Complaints received based on Article 56 and 61 of the GDPR
Through the IMI registrations under no. 179746 (based on Art. 56 from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter referred to as „GDPR”), no. 311264 (based on Art. 61 of the GDPR), no. 311285 (based on Art. 61 of the GDPR), the National Supervisory Authority for Personal Data Processing was notified by the Data Protection Authority (DPA) from Hungary regarding the complaints submitted by three natural persons from this country against Dante International SA. DPA Hungary considered the National Supervisory Authority for Personal Data Processing (hereinafter referred to as „ANSPDCP”) as being the lead supervisory authority (LSA) in this case, considering that this company has the main headquarters in Romania. The proposal of DPA Hungary was accepted by ANSPDCP.
We hereby present a synthesis of the three complaints and of the results of the investigations performed by ANSPDCP in these cases. The detailed presentation of the ANSPDCP’s steps and of the controller’s replies is to be found within the minutes of findings no. 7538/19.04.2023, that will be provided in copy to Dante International SA, together with this decision.
# A. [REDACTED] Case
- IMI 179746 (Art. 56)
# Object of the complaint
Following the analysis of the annexes to the IMI registration, it was found that Mr. [REDACTED] has requested on 30.06.2020 the erasure of the account created on emag.hu, by having a correspondence in this respect on the address [email protected]. Within the response received from this address, signed by [REDACTED], clients’ representative, [REDACTED] was requested to send a dated and signed request (scanned or photographed) at the address [email protected]. [REDACTED], unsatisfied with the fact that more information than at the creation of the account is requested to him, addressed a complaint to DPA Hungary on 03.07.2020.
# **Conclusions:**
From the investigation performed by ANSPDCP, but also from the personal data privacy policy published on the emag websites (emag.ro, emag.hu, emag.bg) it did not result that, within the procedure for the handling of the requests for the erasure of the data (or regarding the other rights provided under the GDPR), Dante International SA would impose the submission of a signed and dated request, scanned or photographed, as it was requested to [REDACTED] by the commercial department from Hungary. Thus, at the date of the complaint and of the start of the investigations, the requests of the data subjects needed to be addressed to the e-mail address [email protected], all the requests at the group level being automatically redirected to a unique central address of the controller, [email protected]. In the case of the website emag.ro, in addition, the possibility of sending the requests also by post or courier to a physical correspondence address of Dante International S.A. was indicated.
Therefore, it cannot be concluded that, at the level of the group of companies for which Dante International SA is main establishment, in the sense of Article 4 point 16 letter a) of the GDPR, such a procedure would exist, but rather, in the case reported by [REDACTED] it represents a specific matter, at the level of the Hungarian entity (Dante International Korlátolt Felelősségű Társaság, currently with the name Extreme Digital-eMAG Korlátolt Felelősségű Társaság). The controller declared that the “case of [REDACTED] is a singular one”, under the conditions that, “at the level of the Dante group, an average of 1000 requests for the exercise of personal data rights are received every month to the dedicated e-mail addresses”.
However, the lack of a regular and adequate training of the group’s employees by Dante International SA was found, specifically of those from Dante International Korlátolt Felelősségű Társaság (currently, Extreme Digital-eMAG Korlátolt Felelősségű Társaság), regarding the procedure to be followed for the handling of the data subjects’ requests. From the controller’s response it resulted that the training of the personnel from the Hungarian entity is performed at the hiring (based on a training manual), and within each entity of the group, and subsequently, in “specific situations and customized to each department”. The proofs sent are referring to the communication of a document “Internal eMag policy for personal data processing”, by e-mail, on 27.12.2018.
Or, according to Article 24 of the GDPR, the controller shall implement adequate technical and organisational measures, including adequate policies for data protection, in order to guarantee and be able to prove that the processing is performed in accordance with the GDPR. These policies should approach correspondingly the handling of the requests received from the data subjects and the performance of some regular training sessions of the personnel involved in the processing of personal data.
On the other hand, in cases such as that of [REDACTED], even in case a person would not address to the contact data dedicated to the exercise of the rights, but to other public contact data used for the customers’ relations, the controller has the obligation to handle the requests of the data subjects (subject to their clear identification), according to the provisions of Article 12 of the GDPR, that also imposes the obligation of facilitating the exercise of the data subjects’ rights based on Articles 15-22 of the GDPR. Therefore, it should be provided, for example, the possibility of redirecting, without unjustified delays, the request received on other contact data to the internal addresses from the group dedicated for the handling of the requests based on the GDPR provisions. Or, the existing procedure was imposing to the employees from the group that received such requests to guide the data subjects to contact directly the company on one of the dedicated addressed. In this respect, we reiterate the importance of a proper training of the employees/persons processing personal data under the authority of the controller, from all the entities that are part of the Dante group.
In the particular case of [REDACTED], although his request from 30.06.2020 was not immediately handled correspondingly, however after the start of the investigation by the Hungarian DPA, the controller decided to erase the data of the claimant, on 20.08.2020, within the deadline, so reasonably, within the maximum deadline of 3 months provided under Article 12 paragraph (3) of the GDPR.
2
We mention that Article 17 paragraph (1) letter b) of the GDPR provides the following:
"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(...)
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing."
Therefore, a violation of the provisions of Article 12 paragraph (2) and of Article 17 paragraph (1) of the GDPR regarding the controller's obligation to facilitate the exercise of data subjects and to delete personal data without undue delay is found.
Following the investigation, the controller amended its personal data privacy policy published on the emag websites, offering to the data subjects the possibility to send the requests based on the GDPR both on e-mail (at an address such as [email protected]) and by post/courier at a physical address from that state.
The method of "anonymisation" used by Dante (hash MD5) is considered to present some risks for the data subjects to be reidentified (see in this respect the Opinion 05/2014 on "Anonymisation Techniques of Article 29 Working Party, WP 216, from 10th of April 2014, pages 21-22). In this respect, ANSPDCP considers that the implementation of an anonymisation method through which the risk of reidentification of the data subjects whose personal data are subject to this procedure to be prevented is necessary, according to Article 32 of the Regulation (EU) 2016/679 (for example, the SHA-256 method that generates 64 characters).
# B. Case
# - IMI 311264 (Art. 61)
# Object of the complaint
From the analysis of the documents sent, it is found that claims that on the website emag.hu an account with the personal data of the client is created automatically, even when he wishes to place an order without the creation of an account, aspect considered by the Hungarian DPA as not being necessary in the steps that precede the conclusion of a contractual relationship. Also, he claimed that the box regarding the consent for receiving newsletters was pre-checked. The claimant requested the erasure of his data on 4th of July 2020 (to [email protected], [email protected], [email protected]), but this was not possible, given that the emag servers rejected his request as originating from an address that is not secure ( ). The claimant argues that on 16th of July 2020 he received an answer (from [email protected], ) within which it is brought to his knowledge that the error message was forwarded to the competent colleagues, and on 18th of July 2020 he received an answer within which again it is indicated to address to [email protected]. On 19th of July 2020 the claimant argues that he received again an error message from the e-mail server, according to which his request was not delivered to any of the addresses. The claimant also states that a data protection officer is not available.
# Conclusions:
From the investigation performed by ANSPDCP, it resulted that the procedure for the automatic creation of an account at the placement of an order on the emag online commerce websites is visibly brough to the knowledge of the data subjects (that do not have or do not wish to create on their own an account), on the same screen where the data related to the delivery are requested. This procedure allows the controller to handle the orders placed on the online electronic commerce platform, the personal data being those necessary for providing the confirmation of the order and for invoicing.
Also, information on the processing of the personal data and the creation of the account are provided inclusively within the documents available on the emag websites, in relation to the personal data protection and the general terms of use of the services of the controllers from the Dante International group.
3
Considering the specifics of the activity in which personal data is processed (sale-purchase of products by taking an online order, which is equivalent to concluding a distance contract), the legal provisions of Government Emergency Ordinance no. 34/2014 regarding consumer rights in the framework of contracts concluded with professionals, as well as for the modification and completion of some normative acts (which transposes Directive 2011/83/EU in Romania), as well as the provisions of fiscal and accounting legislation, in the case of personal data requested for invoicing are inclusively applicable. Also, the data related to the delivery address is necessary for the execution of the contract, and data such as the e-mail address or the telephone number are necessary for the confirmation of the receipt of the order and the actual delivery of the ordered product.
Therefore, it follows that such processing is legal, compared to the provisions of Article 6 paragraph (1) letters b), c) and f) of the GDPR.
Regarding the claim of the petitioner according to which the box regarding the receipt of newsletters was pre-checked, it was found that the petitioner did not submit evidence in this regard, and the investigation did not result in elements to confirm these claims. Thus, the controller simulated the placing of an order with the automatic creation of a new account, without any pre-checked boxes regarding receiving the newsletter being visible. It can still be seen on the website that, at the time of account creation, an user can tick or not if they want to receive “the best offers”.
The information of the data subjects from the personal data policy on the emag websites was updated in relation to the transfer of data abroad.
Pursuant to Article 13 paragraph (1) letters c), e) and f) and Article 14 paragraph (1) letters c), e) and f) of the GDPR, the controller has to inform the data subjects including about the following:
- (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
- (e) the recipients or categories of recipients of the personal data, if any;
- (f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
Since, at the start of the investigation (date of ANSPDCP’s letter no. 21958 of 09.12.2021, sent to Dante International SA), the information on the emag.hu website did not contain complete information on transfers to third countries, purposes and recipients in this context, a violation of the above provisions is found.
Regarding the automatic rejection of the requests of the claimant through which he requested the erasure of the data, the controller argues that its servers use the public lists provided by Cisco Talos Intelligence Group, maintained by a third party, on which the controller does not hold the control, and that situation was a possible one generated by the weak/bad reputation of the service @freemail.hu at the moment when the claimant sent those requests to Dante.
Although the controller claims that it did not receive the requests of the claimant of the 4th of July 2020 (sent to [email protected]), the 11th of July 2020 (sent through the contact form from the website), of 18th of July 2020 (sent to [email protected], [email protected], [email protected]), after the start of the investigation by the Hungarian DPA, it erased the account of the claimant on 04.02.2021. The claimant was informed by Dante at the same date, by e-mail.
From the analysis of the proofs sent by the claimant, however it results that on 16th of July 2020 (probably, in the case of the request addressed through the contact form), [REDACTED] received an answer (from [email protected], [REDACTED]) through which it is brought to his knowledge that the error message was forwarded to the competent colleagues. In this case, there was the possibility (as retained also above in the case of [REDACTED]) for the request for erasure of the data addressed by the claimant to be redirected without unjustified delays, to the internal addresses from the group dedicated to the handling of the requests based on the GDPR provisions.
Also, within the investigation, the controller brought to the knowledge of ANSPDCP that it has subsequently adopted as remediation measure the information of the teams for the
4
communication with the data subjects that they have the obligation to redirect internally the requests of the clients that report technical issues such as the rejection of some messages sent via e-mail.
We mention that Article 17 paragraph (1) letter b) of the GDPR provides the following:
"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
(...)
(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing."
The situation found in the case of [REDACTED] which, in contrast to [REDACTED], had addressed to the e-mail address dedicated to the submission of the requests based on GDPR ([email protected]/emag.ro), proves that the establishment of a single and exclusive channel of communication that the data subjects can use, as well as the lack of an adequate information regarding some limitations from the technical point of view (such as the "e-mail filtering" solutions applied on the Dante servers) can lead to the groundless restriction of their rights.
Therefore, in this case a breach of the provisions of Article 12 paragraph (2) and of Article 17 paragraph (1) of the GDPR regarding the obligation of the controller to facilitate the exercise of the data subjects' rights and to delete personal data without undue delay is found.
Following the investigation, the controller amended its personal data policy published on the *emag* websites, by offering to the data subjects the possibility to send the requests based on the GDPR both by e-mail (at an address type [email protected]) and by post/courier at a physical address from that country.
### C. [REDACTED] Case
#### - IMI 311285 (Art. 61)
##### **Object of the complaint**
From the analysis of the documents sent, it is found that [REDACTED] claims that Dante has not communicated him what personal data it processes, following his request for change of the e-mail address associated to the *emag* account from 29$^{th}$ of March 2020. The claimant argues that, although he sent by post this request to Extreme Digital-eMAG Ltd. (received on 22$^{nd}$ of January 2021, by presenting the proof of delivery by post of this letter), he did not receive any answer. The request was sent to the address 1074 Budapest, Rákóczi út 70-72, mentioned on the website emag.hu, section dedicated to the processing of personal data, at the contact information of the controller Extreme Digital-eMAG Kft. In this request, the claimant was reporting also other aspects regarding the use of a voucher, for which he received an answer. The claimant did not present the actual copy of the request through which he claims that he exercised his right of access.
Moreover, the claimant shows that the e-mail address [REDACTED] was still processed by Dante (responses/messages received on this address on 26.11.2020, 28.12.2020, 25.01.2021 and on 28.01.2021), although he has requested its replacement with the address [REDACTED]; on 14.01.2021 he had requested on the e-mail information regarding the processing of his personal data, request that did not receive a request.
##### **Conclusions:**
From the investigation performed by ANSPDCP, no definite evidence regarding the fact that [REDACTED] exercised his right of access provided under Article 15 of the GDPR, through a letter sent to Extreme Digital-eMAG Korlátolt Felelősségű Társaság on 22.01.2021 could be retained. The controller sustained that no such request was received.
Regarding the request of rectification of the e-mail address of the claimant, from [REDACTED] to [REDACTED], although its initial request from 16.04.2020 was favourably solved on 15.05.2020, when the controller confirmed to the claimant the rectification of his e-mail address, the address [REDACTED] continued to be processed by Dante, in the context of a correspondence held with the claimant within the period November 2020 – January
5
2021, regarding the request of a voucher associated to a previous order (from 22.11.2019) correspondence that used this address. Thus, although the claimant has started the correspondence on 22.11.2020 from the address [REDACTED], the controller responded on the address [REDACTED], corresponding to the data from the order that was subject to the claim of the claimant. According to the statements of the controller, the e-mail address [REDACTED] continued to be saved in the database for the purpose of fulfilling the legal obligation to keep the accounting justifying documents, considering the electronic invoices previously provided.
We consider that this purpose of the processing is different from the one related to the handling of the claims, to the reactivation of this address and its use within the electronic correspondence would have been possible only based on the consent of the data subject, more as the context in which the claimant justified the request for rectification of the address based on the reason that it will be changed. Therefore, continuing to process the e-mail address [REDACTED], within the correspondence started on 22$^{nd}$ of November 2020, without the consent of [REDACTED] breaches the provisions of Article 6 paragraph (1) letter a) of the GDPR.
Within the investigation, the controller amended its internal procedure in order not to allow the use within the electronic correspondence with the data subject of an e-mail address for which a request for rectification previously existed.
## **II. Cooperation steps with the concerned supervisory authorities**
Following the investigation performed, ANSPDCP electronically informed through IMI the other supervisory authorities, including the Hungary authority, within an informal consultation procedure, based on Article 60 from GDPR, regarding the conclusions resulted from the investigations performed within the three cases, as well as the intention of our institution to finalise them through a decision through which two fines and two corrective measures are to be applied, by detailing them (registration no. 440085). The only comment introduced by another supervisory authority was the one from the authority from France that does not consider to be a concerned authority.
As a result, a draft decision was drafted, based on the report and the minutes of findings drafted pursuant to Article 60 of Regulation (EU) 679/2016 and of Article 16 paragraph (3), (5), (6), (7) of Law no. 102/2005, republished (registered under no. 467153).
The Data Supervisory Authority from Hungary formulated in IMI, on 09.01.2023, both relevant and reasoned objections (with the proposal to establish the violation including of the provisions of Article 17 paragraph (1) of the GDPR in the case of the complaints submitted by [REDACTED] and [REDACTED] and of Article 13 paragraph (1) and Article 14 paragraph (1) of the GDPR, as well as with objections regarding the effectiveness, proportionality and dissuasiveness of the fines, proposing the application of a more severe fine), as well as comments (regarding the pre-checking of the newsletter section and the mandatory creation of an online account).
By considering the objections thus formulated, in accordance with Article 60 paragraph (4) of the GDPR, ANSPDCP reviewed the draft decision (registration no. 484845 from IMI), to which the concerned supervisory authorities did not submit any relevant and reasoned objections.
Following the receipt of some comments drafted by the Authority for the Personal Data Protection from Hungary on 21.02.2012, the draft of the decision was completed, thus resulting this final decision.
## **III. The minutes of the findings**
Following the investigation carried out and the consultations with the other supervisory authorities, the minutes of the findings no. 7538/19.04.2023, through which the following deed were found, was drafted:
1. "At the date of this minutes, it is found that Dante International SA, with the identification data and headquarters mentioned on the first page of this minutes
6
has breached the provisions of Article 12 paragraph (2), in conjunction with Article 17 of the GDPR, as well as of Article 17 paragraph (1) of the GDPR regarding the controller's obligation to facilitate the exercise of data subjects and to delete personal data without undue delay, in particular in the case of the complaints submitted by [REDACTED] (for the request for the erasure of the data from 30.06.2020) and [REDACTED] (for the requests for the data erasure, submitted in July 2020), according to the findings from this minutes.
This deed represents the contravention provided under Article 12 of Law no. 190/2018, by reference to the provisions mentioned under Article 83 paragraph (5) letter b) of the GDPR.
2. At the date of this minutes, it is found that Dante International SA, with the identification data and headquarters mentioned on the first page of these minutes, violated the provisions of Article 13 paragraph (1) letters c), e), f) and Article 14 paragraph (1) letters c), e), f) of the GDPR, since at the start of the investigation (the date of the ANSPDCP's letter no. 21958 of 09.12.2021 sent to Dante International SA), the information on the emag.hu website did not contain complete information on the transfers to third countries, the purposes and recipients of the data in this context, according to the findings in this report
This deed represents the contravention provided under Article 12 of Law no. 190/2018, by reference to the provisions mentioned under Article 83 paragraph (5) letter b) of the GDPR.
3. At the date of this minutes, it is found that Dante International SA, with the identification data and headquarters mentioned on the first page of this minutes, has breached the provisions of Article 6 paragraph (1) letter a) of the GDPR, given that it continued to process the e-mail address [REDACTED] within the correspondence started on 22nd of November 2020, without the consent of the data subject, for the complaint submitted by [REDACTED], according to the findings from this minutes.
This deed represents the contravention provided under Article 12 of Law no. 190/2018, by reference to the provisions mentioned under Article 83 paragraph (5) letter a) of the GDPR."
Given that in this case Dante International SA performs a cross-border processing, the provisions of Article 60 of Regulation (EU) 2016/679 become applicable, as well as those of Article 16 paragraphs (3), (5), (6), (7) of Law no. 102/2005, republished, that provide for the application of the sanctions/corrective measures through a decision of the ANSPDCP's President, based on the minutes of control and findings drafted by the control personnel.
# IV. Arguments and decision:
Considering the conclusions resulting from the investigations carried out at Dante International SA, a company that through the emag website (with versions in the official language of the three countries: Romania, Hungary and Bulgaria) carries out personal data processing operations in the context of ordering products which are sold online (directly or through partners), and the entities for which Dante International SA declares to be a data controller with its main headquarters are: DANTE INTERNATIONAL S.A., with its registered office in Romania, Extreme Digital-eMAG Korlátolt Felelősségű Társaság, with registered office in Hungary and EMAG INTERNATIONAL OOD, with registered office in Bulgaria,
7
Taking into account the relevant and reasoned objections sent by the Hungarian Data Protection Authority,
Having regard that, according to the latest records available from the National Trade Register Office (on 25.01.2023), the net turnover of DANTE INTERNATIONAL SA in 2021 was 7346114540 lei, for 2022 this information not being available yet,
Given that, from the verification of the ANSPDCP registers, it resulted that based on the GDPR there have been taken sanctions against Dante International SA, the only fines being of 3,000 EUR (Lei 14,420.4) for the processing without consent of the e-mail address of a claimant (the findings/sanction minutes no. 4471/27.02.2020), respectively of 1000 EUR (4918.6 lei) for non-compliance with the right to delete the data of a data subject (minutes of findings no. 21141/08.12.2022),
Based on the deeds found through the minutes of findings no. 7538/19.04.2023 above mentioned,
Considering the provisions of Article 12 paragraph (3) of the GDPR, according to which: “The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.”, provisions applicable also for the exercise of the right to erasure of the data regulated under Article 17 of GDPR, as well as under Article 17 paragraph (1) of the GDPR regulating the obligation of the controller to delete personal data without undue delay, provisions which were breached for the complaints submitted by [REDACTED] and [REDACTED],
Since at the start of the investigation (date of ANSPDCP’s letter no. 21958 of 09.12.2021, sent to Dante International SA), the information on the emag.hu website did not contain complete information on transfers to third countries, purposes and recipients in this context, according to the provisions of Article 13 paragraph (1) letters c), e), f) and Article 14 paragraph (1) letters c), e), f) of the GDPR,
By reference to the provisions of Article 6 paragraph (1) letter a) from GDPR, according to which the processing is legal only if and to the extent that the “data subject gave his/her consent for the processing of his/her personal data for one or more specific purposes”, provision breached also in relation to the processing of the e-mail address of [REDACTED], which rectification was later on confirmed,
Considering that the fine that can be imposed for the violation of the provisions listed above is up to 20,000,000 EUR or, in the case of an undertaking, up to 4% of the total annual worldwide turnover corresponding to the previous financial year, according to Article 83 paragraph (5) letter b) and a) of the GDPR,
Having regard to the provisions of Article 83 paragraphs (1) – (3) of the GDPR, according to which:
“(1) Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
(2) Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
- (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
- (b) the intentional or negligent character of the infringement;
- (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;
8
(d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;
(e) any relevant previous infringements by the controller or processor;
(f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
(g) the categories of personal data affected by the infringement;
(h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;
(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;
(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and
(k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
(3) If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.”
Taking into account the criteria for individualising the fines established by Article 83 paragraph (2) and (3) of the GDPR, according to which the fines below were determined based, in particular, on the following aspects:
- the nature, gravity and duration of the infringement – non-compliance with the transparency conditions provided by Article 12 of the GDPR regarding the facilitation of the exercise of the rights of data subjects at the level of the company in Hungary (part of the Dante group) and implicitly, the non-immediate adoption of measures to delete personal data in the case of two data subjects from this country, according to Article 17 of the GDPR; failure to provide complete information on the emag.hu website in relation to the transfer of data to third countries, according to Article 13 and 14 of the GDPR; the policy for managing the requests of data subjects to exercise the rights provided for by the GDPR, which, at least in the case of the Hungarian company, limited the ways of submitting requests to a single communication channel (a dedicated email address);
- the negligent character of the controller’s guilt in these cases;
- the mitigation measures of some of the reported issues, adopted by the controller during the investigations undertaken by the Hungary DPA and by the ANSPDCP, both in the particular cases of the petitioners, as well as regarding the general procedures applied by the controller;
- the types of personal data processed in the case of applicants – specific personal data for taking an online order, payment and delivery of the ordered product (in particular, name, surname, e-mail address, telephone number, delivery and/or billing address);
- the previous sanctions imposed by ANSPDCP against Dante International SA, a greater relevance presenting the fines mentioned above;
Taking into account the mitigating nature of some of the circumstances, such as: the small number of reported cases for which violations of the provisions of the RGPD were retained; failure to prove any damages suffered by the persons concerned/petitioners; adopting remedial measures for some of the reported issues; cooperation with the supervisory authority during the investigations undertaken; the relatively small number of sanctions consisting of fines applied previously,
Taking into account, in conclusion, the violations found, the elements of individualisation of sanctions, identified under Article 83 paragraph (2) of the GDPR, as well as the turnover of Dante International SA, based on which the ANSPDCP proceeded to analyse the effectiveness, proportionality and dissuasive effect of the fines applied,
The need to implement a method of anonymisation through which the risk of re-identification of the personal whose personal data are subject to this procedure to be prevented,
9
The importance of the regular training of the personnel from all the companies which are part of the Dante companies' group, in relation to the procedure that needs to be followed for the correct handling of the requests submitted by the data subjects based on the GDPR,
The groundless character of some of the aspects invoked within the complaints submitted by [REDACTED] and [REDACTED], according to the findings resulted from the investigations performed by ANSPDCP, above detailed, in relation to the procedure for the automatic creation of an account at the placement of an order on the emag websites and the pre-checking of the box regarding the receipt of newsletters (in the case of the complaint of [REDACTED]), respectively in relation to the exercise of the right to access (for the complaint of [REDACTED]), for which the procedure is to be followed according to Article 60 paragraph (9) of the GDPR,
Based on the provisions of Articles 14, 15 and 16 of Law no. 102/2005, republished, of Article 12 of Law no. 190/2018, with reference to Article 83 paragraphs (2) and (3) and to the provisions listed under Article 83 paragraph (5) letters a) and b) of Regulation (EU) 2016/679, in conjunction with the provisions of Article 58 paragraph (2) letters i) and d), as well as those of Article 60 of Regulation (EU) 2016/679, with reference to the provisions of Articles 24, 25 and 26 from the Procedure for conducting investigations, approved through the Decision of the ANSPDCP's President no. 161/2018, as well as on the provision of Government Ordinance no. 2/2001,
# The National Supervisory Authority for Personal Data Processing
# DECIDES
# the following measures against Dante International SA:
1. The application of a fine in amount of Lei 148,830, the equivalent of 30,000 EUR, for the first deed found based on the minutes of findings no. 7538/19.04.2023, based on Article 83 paragraph (5) letter b) of Regulation (EU) 2016/679, for the breach of the provisions of Article 12 paragraph (2) and of Article 17 paragraph (1) of Regulation (EU) 2016/679;
2. The application of a reprimand for the second deed found based on the minutes of the findings no. 7538/19.04.2023, based on Article 58 paragraph (2) letter b) of Regulation (EU) 2016/679 for the breach of the provisions of Article 13 paragraph (1) letters c), e), f) and of Article 14 paragraph (1) letters c), e), f) of Regulation (EU) 2016/679;
3. The application of a fine in amount of Lei 49,610, the equivalent of 10,000 EUR, for the third deed found based on the minutes of findings no. 7538/19.04.2023 based on Article 83 paragraph (5) letter a) of Regulation (EU) 2016/679, for the breach of the provisions of Article 6 paragraph (1) letter a) of Regulation (EU) 2016/679;
4. Application of the corrective measure provided by Article 58 paragraph (2) letter d) of Regulation (EU) 2016/679 to ensure the full information of data subjects, by providing all the information mentioned in Articles 13 and 14 of Regulation (EU) 2016/679, including in the context of the transfer of personal data to third countries, information to be available on emag websites managed by the controller, in the national language version of each country – deadline: 30 days from on the date of communication of this decision;
5. The application of the corrective measure provided under Article 58 paragraph (2) letter d) of Regulation (EU) 2016/679 to implement an anonymisation method in order to prevent the risk of re-identification of the persons whose personal data are subject of this procedure, according to Article 32 of Regulation (EUO 2016/679 – deadline: 30 days as of the communication of this decision;
6. The application of the corrective measure provided under Article 58 paragraph (2) letter d) of Regulation (EU) 2016/679 to take measures for the regular training of the personnel from the companies from Romania, Hungary and Bulgaria, that are part of the Dante companies' group, in relation to the procedure that needs to be followed for the correct handling of the requests submitted by the data subjects based on Regulation (EU) 2016/679 – deadline: 30 days as of the communication of this decision.
10
**Dante International SA** will communicate to ANSPDCP the measures taken for the application of the corrective measures within 45 days as of the receipt of this decision.
This decision was subject to the procedure provided under Chapter VII of Regulation (EU) 2016/679, being provided to the concerned supervisory authorities.
According to Article 15 paragraph (6) of Law no. 102/2005, republished, when applying the fine, the official exchange rate of the National Bank of Romania of 17.05.2023, hour 14:28 was taken into consideration (EUR 1= Lei 4.9610).
According to the provisions of Article 17 paragraph (3) from Law no. 102/2005, republished, **Dante International SA** has the obligation to pay the fine within 15 days as of the communication of the minutes of the findings (attached in copy) and of this decision, contrary following to be proceeded to enforcement.
The fine will be paid in the account of the State Treasury where **Dante International SA** has his fiscal headquarters, account code 20A350102, within 15 days from communication, following for a copy of the receipt or payment order to be sent to the National Supervisory Authority for Personal Data Processing within the same deadline.
Article 83 of Regulation (EU) 679/2016 only provides for the maximum threshold of the fines that can be applied, not for their minimum limit, so that Article 28 paragraph (1) of Government Ordinance no. 2/2001, with its subsequent amendments and completion, regarding the possibility to pay half of the minimum of the fine provided under the normative act, does not apply in this case.
This decision, together with the minutes no. 7538/19.04.2023 (attached in copy), is communicated to **Dante International SA** that it has the right to challenge them, according to Article 17 of Law no. 102/2005:
“Article 17
(1) The data controller or processor may file an appeal against the report of the finding/sanctioning and/or the decision to apply the corrective measures, as the case may be, with the administrative contentious section of the competent court, within 15 days from handing, respectively from communication. The decision resolving the appeal can be appealed only by appeal. The appeal is judged by the competent court of appeal. In all cases, the competent courts are those in Romania.
(2) The report of finding/sanctioning or the decision of the president of the National Supervisory Authority unchallenged within 15 days from the date of handing, respectively the communication, constitutes an enforceable title without any other formality. Introducing the appeal provided in paragraph (1) suspends only the payment of the fine, until a final court decision is issued.
(3) The deadline of payment of the fine is 15 days from the date of handing, respectively from the date of communication of the minutes of finding/sanctioning or of the decision of the president of the National Supervisory Authority.”
**President,**
11