Sanction RGPD Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Kaufland Romania SCS : 2 k€ (2022)
- Autorité de contrôle
- Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Pays
- Roumanie
- Entreprise / secteur
- Kaufland Romania SCS
- Montant de l'amende
- 2 k€
- Date de la décision
- 3 juin 2022
- Fondement juridique
- Art. 29, Art. 32 (1) b), Art. 32 (2), (4)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Romanian DPA has imposed a fine of EUR 2,000 on Kaufland România SCS. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. An employee who processed a complaint had not followed the internal procedure for handling complaints, allowing a security guard to view and misuse the complainant's data. In addition, the controller had mistakenly forwarded the data in a customer order form to an unauthorized third party. This led to the disclosure of personal data (first name, last name, e-mail address, telephone number) of the affected Kaufland customer. For this reason, the DPA found that the controller had not taken appropriate technical and organizational measures to ensure the protection and security of personal data.
Décision officielle
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)