On debt collection in Romania 

The petitioner denounces the practice of foreign debt collection agencies (DCAs) that purchase debts from Romanian companies, mostly banks, and then assign the collection to Romanian DCAs. The petitioner claims that enforcement proceedings brought by the latter are in breach of Romanian law, which does not allow them to represent another legal entity in court. He also claims that DCAs violate the GDPR because they process personal data of debtors with whom they were never in direct contact and who never gave their consent to that effect. The petitioner maintains that foreign DCAs are in fact investment firms as defined by Directive 2014/65/EU and perform investment activities on a professional basis, meaning that they should be authorised in both Romania and their country of origin, which is not the case.Information– The petitioner alleges the breach of the following EU legislation: i) Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR); ii) Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data; iii) Directive 2014/65/EU on markets in financial instruments; iv) Regulation (EU) No 575/2013 on prudential requirements for credit institutions and investment firms.