The Romanian data protection authority (ANSPDCP) has published a report on court decisions related to challenges against its sanctions for the period 2023-2025.

Out of 73 appeals filed against its sanction decisions, 22 have been definitively judged. The ANSPDCP prevailed in 19 of these cases. Eleven fines were fully upheld by the courts against the operators Libra Internet Bank SA (€11,000), Partidul Uniunea Salvați Romania (€3,000), Body Line SRL (€10,000), E.On Energie Romania SA (€5,000), Medijobs Platform SRL (€5,000), CN Poșta Română (€5,000), Technik Leb SRL (€3,000), OTP Bank Romania SA (€3,000), Synobis Medical SRL (10,000 lei, approximately €2,000), Primăria Comunei Albeni (10,000 lei, approximately €2,000) and an individual (€450). In three other cases, fines were replaced by warnings, and five warning sanctions were confirmed. However, three complaints were upheld in favor of the operators.

The Bucharest Tribunal confirmed the €3,000 fine imposed on Partidul Uniunea Salvați Romania for violation of Article 5 paragraph 1 points a) and b), Article 6 paragraph 1 and Article 9 paragraph 2 of the GDPR. The party had made personal data (names, addresses, identity numbers, medical certificates) extracted from public authority websites accessible and searchable on its site without legal basis or consent. The court deemed the sanction lawful and proportionate, noting that the data controller did not contest the facts. The party did not appeal and paid the fine.

The Bucharest Court of Appeal upheld fines totaling €11,000 against Libra Internet Bank SA for breaches of Article 12 paragraphs 2 and 4 and Article 15 paragraphs 3 and 4 of the GDPR. The bank had refused to communicate to a client their personal data and related video recordings. The court described the bank's attitude as "opaque," considering the breach not to be of minor severity. The argument that the client's request was abusive was rejected, as the bank did not demonstrate it was "manifestly unfounded or excessive" within the meaning of Article 12 paragraph 5. The operator's recidivism was also taken into account.

The Cluj Court of Appeal upheld the sanction of 10,000 lei (approximately €2,000) and the warning issued against Synobis Medical SRL. The fine concerned a violation of the local privacy and electronic communications law (Law No. 506/2004) relating to cookies, and the warning a breach of Articles 12 to 14 of the GDPR. The company used cookies on its website without obtaining prior consent from users or properly informing them. The court deemed the fine proportionate, considering a mere warning insufficient due to the "social danger" posed by non-compliance with cookie rules. Mitigating factors, such as negligence and absence of prior similar sanctions, justified a minimum legal fine.