One-Man Controller – The Responsibility Of Individuals Under The GDPR

In a recent sanctioning decision, the Romanian Data Protection Authority (“ANSPDCP”) applied multiple administrative fines to a natural person, amounting to a total of EUR 10,000. While the total sum exceeds the standard level of fines generally applied by ANSPDCP, it may be considered a rather surprising amount fora natural person. Moreover, the facts of the case themselves are particularly noteworthy.

ANSDPCP investigated the situation after having received two complaints about personal data being published on a website which was, in essence, dedicated to exposing scammers. The amount of the sanction was reached based on multiple infringements which refer to cooperation failure with the authority, lack of legal basis for the processing activities, transparency breaches vis-à-vis the data subjects, violation of data subject rights, especially right to erasure, and publication of sensitive data of sexual and criminal nature.