[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu8bEZbENj9hJOeoA0JqJECl4-GLmnh9oyMBnKaslSHk":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"23c6e2f4-c4d8-4b8b-a7e6-bb6d4d9f31ad","ANSPDCP (Romania) - Fine against Dormeo Home S.R.L","anspdcp-romania-fine-against-dormeo-home-s-r-l-1d0f25","← Older revision Revision as of 12:58, 15 September 2026 Line 84: Line 84: }} }} The Romanian DPA fined a bedding retailer RON 10,517 (€2,000) for infringing Art. 21 GDPR by continuing to send marketing calls and SMS messages after the data subject exercised their right to object. The Romanian DPA fined a bedding retailer RON 10,517 (€2,000) for infringing [[Article 21 GDPR]] by continuing to send marketing calls and SMS messages after the data subject exercised their right to object. == English Summary == == English Summary == Line 90: Line 90: === Facts === === Facts === Dormeo Home S.R.L. (the controller), received a request from one of its customers (the data subject) exercising their right to object to direct marketing. Despite this objection, the controller continued to send marketing calls and SMS messages to the data subject, who lodged a complaint with the Romanian DPA on this matter. Dormeo Home S.R.L. (the controller), received a request from one of its customers (the data subject) exercising their right to object to direct marketing. Despite this objection, the controller continued to send marketing calls and SMS messages to the data subject, who lodged a complaint with the Romanian DPA on this matter. === Holding === === Holding === The DPA held that the controller had violated [[Article 21 GDPR|Article 21 GDPR]] by continuing to contact the data subject for direct marketing purposes after the data subject had exercised their right to object. The DPA considered that the continued transmission of marketing calls and SMS messages constituted unlawful processing of personal data and demonstrated the controller's failure to give effect to the data subject's objection request. The DPA held that the controller had violated [[Article 21 GDPR]] by continuing to contact the data subject for direct marketing purposes after the data subject had exercised their right to object. The DPA considered that the continued transmission of marketing calls and SMS messages constituted unlawful processing of personal data and demonstrated the controller's failure to give effect to the data subject's objection request. In addition, as a corrective measure, the DPA ordered the controller to adopt appropriate technical and organisational measures to ensure GDPR-compliant marketing activities and the effective exercise of data subjects' rights. In addition, as a corrective measure, the DPA ordered the controller to adopt appropriate technical and organisational measures to ensure GDPR-compliant marketing activities and the effective exercise of data subjects' rights. Finally, the Romanian DPA fined the controller €2,000 (RON 10,517) for a breach of [[Article 21 GDPR|Article 21 GDPR]]. Finally, the Romanian DPA fined the controller €2,000 (RON 10,517) for a breach of [[Article 21 GDPR]]. == Comment == == Comment == This decision confirms that, as direct marketing practices become more widespread, controllers must ensure the effective enforcement of data subjects’ rights, in particular the right to object. This decision confirms that, as direct marketing practices become more widespread, controllers must ensure the effective enforcement of data subjects’ rights, in particular the right to object.","The Romanian Data Protection Authority (ANSPDCP) has fined Dormeo Home S.R.L. €2,000 (RON 10,517) for violating Article 21 of the GDPR. The bedding retailer continued to send marketing calls and SMS messages to a customer even after the customer exercised their right to object to direct marketing. The ANSPDCP deemed this unlawful processing of personal data and ordered Dormeo Home to implement measures to ensure GDPR-compliant marketing.","Romanian DPA fines Dormeo Home S.R.L. €2,000 for violating GDPR Article 21.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_Dormeo_Home_S.R.L&diff=53027&oldid=53017","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-09-15T12:58:42+00:00","2026-09-15T14:00:37.476096+00:00",7,[17],{"name":18,"type":19},"Dormeo Home","vendor","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"dormeo-home-fined-for-ignoring-gdpr-opt-out-requests","Dormeo Home Fined for Ignoring GDPR Opt-Out Requests","Dormeo Home S.R.L. continued sending marketing calls and SMS messages to a customer after they explicitly exercised their GDPR right to object, violating Article 21 of the Regulation. This failure demonstrates a breakdown in both process and systems — opt-out requests were not properly recorded, propagated, or enforced across marketing channels. The resulting €2,000 fine, while modest, signals that data protection authorities will act on individual complaints. Beyond financial penalties, such violations erode customer trust and expose organisations to reputational harm. Organisations must treat opt-out signals as legally binding instructions requiring immediate and verifiable action.",[53,54,55,56,57,58,59,60,61],"GDPR Article 21 – Right to Object","GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 5(1)(e) – Storage limitation","GDPR Article 24 – Responsibility of the controller","NIST SP 800-53 PT-3 (Personally Identifiable Information Processing Purposes)","NIST SP 800-53 PT-5 (Privacy Notice)","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","ITIL Service Design – Data and Information Management",{}]