Case study: online store
An online store needs a legal basis for each purpose for which it processes its customers' data (art. 6), must inform them when the data are collected (art. 13) and must explicitly bring to their attention the right to object to direct marketing (art. 21). In this illustrative example, all three were missing.
The situation
An online cosmetics store with around 3,000 orders a month. A social network's tracking pixel collected data on visitors with no established legal basis and without informing them, and the newsletter went to every customer, none of whom had been told of the right to object. The customer list was uploaded to an email marketing platform with servers outside the European Economic Area.
What was missing
- 01The pixel sent the social network data on the pages viewed and the products added to the basket, with no established legal basis. For this marketing purpose, the store could not demonstrate any consent. art. 6 art. 7
- 02The site had no privacy policy, and when placing an order customers did not learn the purposes and legal basis of the processing, the recipients, the storage period or their rights. art. 12 art. 13
- 03The right to object to direct marketing was not explicitly brought to customers' attention, clearly and separately from other information, at the latest at the first communication. art. 21
- 04The email marketing platform received the customer list with no processing contract, and the store had not checked the conditions for transferring the data to a state outside the European Economic Area. art. 28 art. 44
- 05Customer data and inactive accounts were kept with no time limit. art. 5
The risks
A fine for basis and rights
Running the pixel with no legal basis and disregarding the right to object carry fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover in the year preceding the sanction, whichever is higher. In setting the fine, the Centre also takes into account the number of people affected, which is large at thousands of orders a month. art. 6 art. 21 art. 87 art. 88
Emails sent after an objection
Once a customer objects to direct marketing, his or her data are no longer processed for that purpose. Every email sent after the objection can become the subject of a complaint to the Centre, which may order the store to comply with the customer's request. art. 21 art. 60 art. 72
A transfer without safeguards
Data are transferred to a recipient in another state only under the conditions the law lays down. Infringing those conditions carries the same ceiling of 2,000,000 lei or 2%, and the Centre may order the suspension of data flows to that recipient. art. 44 art. 60 art. 88
What is in place now
- 01An established legal basis for each purpose: performance of the contract for orders and delivery, consent for the marketing pixel and, for the newsletter sent to existing customers, a basis checked also against the special rules on electronic commercial communications (the legislation on e-commerce and advertising), which may require the recipient's prior consent. Customers may object at any time. art. 6 art. 7
- 02A cookie banner that does not start the pixel before consent is given and lets visitors withdraw consent as easily as they gave it. art. 7
- 03A published privacy policy, reachable from the order form, so that customers are informed when their data are collected. art. 12 art. 13
- 04A mention of the right to object in every newsletter and a subscriber list with everyone who objected removed. art. 21
- 05A contract with the email marketing platform as a processor, and a verified basis for transferring the data. art. 28 art. 46
- 06Retention periods for orders and for inactive accounts. art. 5
Result
The store now has an established legal basis for each purpose, direct marketing included, checked also against the rules on electronic commercial communications, a published privacy policy, a configured cookie banner, a contract with its email marketing platform and a cleaned-up subscriber list.
For a typical online store
The Essential package + extra work, 19,900 MDL
This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.
Calculate the exact price →FAQ
Questions about this case
Can a social network pixel run on legitimate interests?
Legitimate interests require that the store's interests are not overridden by the interests or rights of its visitors, and tracking behaviour on the site for targeted advertising rarely passes that test. In this example, the store chose consent, which it must be able to demonstrate and which the visitor may withdraw at any time. art. 6 art. 7
How should the right to object be presented in a newsletter?
Explicitly, clearly and separately from any other information, at the latest at the first communication with the customer. After an objection, the data are no longer processed for direct marketing, including profiling related to it. art. 21
Can we use a newsletter platform based abroad?
Yes, if the platform provides sufficient guarantees and has a written contract with the store. If the servers are in a state of the European Economic Area, the rules on transfers do not apply; outside it, the transfer usually rests on a decision of the Centre on the adequacy of the level of protection or on appropriate safeguards. Customers must be told of the intention to transfer their data. art. 13 art. 28 art. 44 art. 45 art. 46
What does the store risk in the law's first year?
The ceilings are those in art. 88, but of the final amount of the fine set by the Centre, 10% applies in the first year after the law enters into force, 40% in the second and 100% from the third. A fine is imposed only if the infringement was intentional or negligent, and for a minor infringement the Centre may issue a warning instead. art. 87 art. 88 art. 90
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.