TS - 703/2026
Romanian court awards damages for GDPR access request refusal.
A Romanian court has awarded an individual RON 1,000 (approximately EUR 190) in immaterial damages. This decision follows the National Railways Company's refusal to provide CCTV footage requested under GDPR Article 15. The Romanian DPA had previously found violations of GDPR articles related to access rights and processing, issuing a warning and ordering the company to provide the footage. The court recognized the data subject's stress and suffering caused by the refusal, deeming it an illicit act under Romanian Civil Code.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Societatea Națională de Căi Ferate CFR SA?
Get an email when a new story names Societatea Națională de Căi Ferate CFR SA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe National Railways Company violated GDPR Article 15 by refusing to provide a data subject with their requested CCTV footage, ignoring both the individual's right of access and a subsequent DPA enforcement order. This case demonstrates that non-compliance with data subject access requests (DSARs) carries real legal and financial consequences beyond regulatory fines, including civil liability for immaterial damages such as stress and suffering. Organizations that dismiss or delay DSARs without lawful justification expose themselves to compounding liability — first from the supervisory authority and then from the courts. The root failure was an absence of clear internal procedures for handling access requests involving surveillance data, combined with a lack of accountability for GDPR obligations.