[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIRE24RYfX7tW7slF7jCcviI90yJ7dV70Uwq5yHrC-ZI":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"de6b1997-8647-4729-9825-1857bdaecaa1","TS - 703\u002F2026","ts-703-2026-e5d4b8","add court logo (due to technical problems in backend ← Older revision Revision as of 14:12, 7 August 2026 Line 3: Line 3: |Jurisdiction=Romania |Jurisdiction=Romania |Court-BG-Color= |Court-BG-Color= |Courtlogo= |Courtlogo=Courts_logo1.png |Court_Abbrevation=TS |Court_Abbrevation=TS |Court_Original_Name=Tribunalul Sibiu |Court_Original_Name=Tribunalul Sibiu","A Romanian court has awarded an individual RON 1,000 (approximately EUR 190) in immaterial damages. This decision follows the National Railways Company's refusal to provide CCTV footage requested under GDPR Article 15. The Romanian DPA had previously found violations of GDPR articles related to access rights and processing, issuing a warning and ordering the company to provide the footage. The court recognized the data subject's stress and suffering caused by the refusal, deeming it an illicit act under Romanian Civil Code.","Romanian court awards damages for GDPR access request refusal.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=TS_-_703\u002F2026&diff=52643&oldid=52642","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-08-07T14:12:57+00:00","2026-08-07T16:00:07.277471+00:00",7,[17],{"name":18,"type":19},"Societatea Națională de Căi Ferate CFR SA","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,28,33,38],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"romanian-railways-faces-court-damages-for-gdpr-access-request-refusal","Romanian Railways Faces Court Damages for GDPR Access Request Refusal","The National Railways Company violated GDPR Article 15 by refusing to provide a data subject with their requested CCTV footage, ignoring both the individual's right of access and a subsequent DPA enforcement order. This case demonstrates that non-compliance with data subject access requests (DSARs) carries real legal and financial consequences beyond regulatory fines, including civil liability for immaterial damages such as stress and suffering. Organizations that dismiss or delay DSARs without lawful justification expose themselves to compounding liability — first from the supervisory authority and then from the courts. The root failure was an absence of clear internal procedures for handling access requests involving surveillance data, combined with a lack of accountability for GDPR obligations.",[53,54,55,56,57,58,59,60,61],"GDPR Article 15 (Right of Access)","GDPR Article 12 (Transparent Information and Communication)","GDPR Article 58 (Supervisory Authority Powers)","GDPR Article 82 (Right to Compensation and Liability)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 IR-7 (Incident Response Assistance)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27001:2022 A.5.34 (Privacy and Protection of Personal Data)","ITIL Service Management — Request Fulfilment Process",{}]