Sanction RGPD Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Banca Comercială Română SA : 2 k€ (2022)
- Autorité de contrôle
- Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Pays
- Roumanie
- Entreprise / secteur
- Banca Comercială Română SA
- Montant de l'amende
- 2 k€
- Date de la décision
- 19 septembre 2022
- Fondement juridique
- Art. 25 (1), Art. 32 (1) b), d), e)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA. The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to an error in the IT application of the controller, emails containing personal data of customers were sent to the wrong recipients. This data breach resulted in the unauthorized disclosure of and access to certain personal data such as first and last name, home address, phone number, email address, and financial information. The incident affected 564 individuals. The DPA found that the bank had failed to take appropriate technical and organizational measures to ensure a level of security commensurate with the processing risk.
Décision officielle
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)