The Romanian authority sanctions an operator for depositing non-essential cookies without prior information or valid consent, pursuant to its national law transposing the privacy and electronic communications directive.

Facts and context

The National Supervisory Authority for Personal Data Processing (ANSPDCP) today published a sanction decision against the company AVIZIERO S.R.L., including the imposition of a fine of 5,000 lei (approximately €1,000), for breaches related to the use of cookies.

The investigation was initiated following a complaint from an individual regarding the deposit of cookies on their terminal equipment during the visit to the operator's website.

Grounds for the decision

• Obligation to obtain consent and provide prior information before depositing cookies (Article 4, paragraph 5, points a and b of Law no. 506/2004): The authority found that the company's website deposited non-technically necessary cookies as soon as the user accessed it. By doing so, the operator stored information and accessed information stored on users' terminal equipment without having obtained their prior consent. Furthermore, no clear and complete information on the purposes of these operations was provided to users before the deposit of these cookies, thus failing to meet the two cumulative conditions required by the applicable national legislation on electronic communications.

Authority's decision

Consequently, the authority imposed a fine of 5,000 lei (approximately €1,000) on AVIZIERO S.R.L.

Lessons learned

This decision confirms / specifies / recalls that:

• User consent must be obtained prior to any deposit or reading of cookies that are not strictly necessary for the functioning of the service.
• Information provided to users about the purposes of trackers must be clear, complete, and presented before any deposit and before obtaining consent.
• The obligations to inform and to obtain consent are cumulative; failure to meet either requirement constitutes a violation.
• By default, upon a user's arrival on a website, no non-essential cookie should be activated.