TS - 703/2026

Summary

A Romanian court has awarded an individual EUR 190 in immaterial damages after the National Railways Company (CFR SA) refused to provide CCTV footage requested under GDPR. The Romanian DPA had previously issued a warning to CFR SA for violating GDPR access rights. The court found that CFR SA's refusal constituted an illicit act, causing the data subject frustration and stress.

Full text

Help TS - 703/2026: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 13:32, 7 August 2026 view source Dalja10 (talk | contribs)6 edits Tag: Decisions [1.0] (No difference) Latest revision as of 13:32, 7 August 2026 TS - 703/2026 [[File:|center|250px]] Court: TS (Romania) Jurisdiction: Romania Relevant Law: Article 12(6) GDPR Article 15(3) GDPR Article 83(5)(b) GDPR Article 1357 Romanian Civil CodeArticle 1381(1) Romanian Civil CodeArticle 1381(2) Romanian Civil CodeArticle 1385 Romanian Civil Code Decided: 03.07.2026 Published: Parties: Societatea Națională de Căi Ferate CFR SA National Case Number/Name: 703/2026 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): Romanian; Moldavian; Moldovan Original Source: Rejust.ro (in Romanian; Moldavian; Moldovan) Initial Contributor: dalja10 A court awarded an individual RON 1,000 (EUR 190) in immaterial damages after the National Railways Company refused to provide, following an access request, CCTV footage of an alleged altercation between him and the police. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Nationala de Cai Ferate SA (the controller). The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject and police agents in front of a railway station. The controller refused to provide the data subject with the requested footage citing the protection of the rights and interests of other persons in the CCTV images. Subsequently, the data subject filed a complaint with the Romanian DPA (ANSPDCP). The DPA found violations of Article 12(6) GDPR, Article 15(3) GDPR and Article 83(5)(b) GDPR and issued the controller with a warning. Moreover, the DPA ordered the controller, among other things, to provide the requested footage, to the extent that it was still available, while following guidelines about sharing such images. In court, the data subject sued the controller for immaterial damages worth RON 3,500 (EUR 665) claiming that its failure to provide the requested footage led to feelings of frustration, stress, injustice and helplessness by being forced to undertake additional steps to make use of his rights and by making it impossible to use the requested footage in other legal cases. Holding The court held that the DPA’s decision attested the infringement of the data subject’s right to access by the controller, meeting the requirements of an illicit act under Article 1357 Romanian Civil Code. Moreover, the court accepted the data subject’s stress and suffering and the causal link between them and the controller’s access request refusal. Therefore, the court awarded RON 1,000 (EUR 190) in immaterial damages to the data subject in accordance with Article 1381(1) Romanian Civil Code, Article 1381(2) Romanian Civil Code and Article 1385 Romanian Civil Code. At the same time, the court considered that the damage was not severe nor prolonged and took this into account when deciding on the amount of damages awarded. Finally, the court dismissed the data subject’s request to order the controller to provide the requested footage since it had already been deleted. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Romanian; Moldavian; Moldovan original. Please refer to the Romanian; Moldavian; Moldovan original for more details. ECLI Code ECLI:RO:TBSIB:2026:001.###### R O M A N I A COURT OF ##### CIVIL DIVISION I Case No. ###/85/2026 Civil Judgment No. ###/2026 Public hearing held on #####, 2026 The Court, composed of: PRESIDING JUDGE: ##### ##### ###### Clerk: ####### ########## #### The ruling in the civil case involving the plaintiff ##### ###### ##### and the defendant REGIONAL RAILWAY BRANCH ######, A SUBDIVISION OF ######## NATIONAL RAILWAY COMPANY “CFR” SA, concerning a tort claim. It is noted that on June 26, 2026, the plaintiff ##### ###### ##### submitted written arguments to the case file via email. It is noted that this case was heard on the merits at the public hearing held on June 24, 2026, when the parties present submitted their arguments, which were recorded in the ruling issued on that date, which forms an integral part of this document, and at which time, the court, needing time to deliberate and to allow the parties to submit written briefs, pursuant to the provisions of Article 396(1) of the Code of Civil Procedure, adjourned the rendering of the judgment until today, July 3, 2026, on which date it deliberated and rendered the following judgment: THE COURT Having deliberated on the present civil case, finds as follows: By the complaint filed with the court ##### on February 5, 2026, under case no. ###/85/2026, the plaintiff ##### ###### ##### filed a lawsuit against the defendant ######## NATIONAL RAILWAY COMPANY “C.F.R.” S.A., through its ###### Regional Railway Branch, requesting that the court’s decision order the following: - that the violation of the plaintiff’s right of access to personal data be established; - that the defendant be ordered to pay moral damages in the amount of 3,500 lei, or in the amount the court deems appropriate; - that the defendant be ordered to provide complete copies of the requested data; - that the defendant be ordered to pay the court costs. In the statement of grounds, the plaintiff stated that, on May 30, 2025, he submitted a request to the defendant for access to personal data, requesting video footage and information regarding the processing of his data. The defendant failed to comply with the obligations set forth in Articles 12 and 15 of EU Regulation 679/2016, and as a result, the claimant filed a complaint with the National Supervisory Authority for the Processing of Personal Data. In its official response issued in case no. 18016/July 18, 2025, the National Supervisory Authority for the Processing of ######## (ANSPDCP) found a violation of the claimant’s right of access and issued a warning to the National Railway Company “CFR” S.A. for violating: Article 12(6) of the GDPR; Article 15(3) of the GDPR•, and Article 83(5)(b) of the GDPR. This finding confirms the existence of the unlawful act and the controller’s fault. The refusal and the unjustified delay caused him stress, uncertainty, and the inability to use the data for lawful purposes and to have evidence for other pending cases. Pursuant to Article 82 of the GDPR, any person who has suffered non-material damage is entitled to compensation. Due to the controller’s refusal and unlawful conduct: his access to his own data was restricted; he was forced to file administrative complaints and take additional steps; he suffered stress and psychological distress and was prevented from using his data in other pending cases. He requests the award of non-pecuniary damages commensurate with the severity of the violation confirmed by the ANSPDCP. In law, the claimant invoked the following legal provisions: Article 15 of the GDPR, the data subject’s right of access; Article 12 of the GDPR, the controller’s obligations; Article 82 of the GDPR, the right to compensation; Article 24 of Law No. 102/2005; Law No. 190/2018; Articles 1349 and 1357 of the Civil Code regarding civil liability in tort. In support of the claim, the plaintiff requested that documentary evidence be admitted, submitting the following (pp. 2–5): ANSPDCP Decision No. 18016/July 18, 2025; the initial request for access to data and the response received from the data controller. The complaint was legally stamped with a court stamp duty in the amount of 270 lei (p. 15). I

Entities