Sanction RGPD Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Kredyt Inkaso Investments RO S.A : 5 k€ (2022)
- Autorité de contrôle
- Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Pays
- Roumanie
- Entreprise / secteur
- Kredyt Inkaso Investments RO S.A
- Montant de l'amende
- 5 k€
- Date de la décision
- 18 mai 2022
- Fondement juridique
- Art. 5, Art. 6, Art. 9, Art. 33
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Romanian DPA has fined Kredyt Inkaso Investments RO S.A. EUR 5,000. A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract. In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.
Décision officielle
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)