Sanction RGPD Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Curtea Veche Publishing SRL : 5 k€ (2022)
- Autorité de contrôle
- Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Pays
- Roumanie
- Entreprise / secteur
- Curtea Veche Publishing SRL
- Montant de l'amende
- 5 k€
- Date de la décision
- 21 septembre 2022
- Fondement juridique
- Art. 32 (1) b), c), Art. 32 (2)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Romanian DPA has imposed a fine of EUR 5,000 on Curtea Veche Publishing SRL. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. In the first data breach, the controller had inadvertently published a file containing the customer database in a public forum. This resulted in the unauthorized disclosure of personal data such as first name, last name, phone number, email, password in encrypted form and IP address of 10,793 customers. The second data breach concerned a ransomware attack that resulted in unauthorized access and loss of integrity as well as availability of personal data of about 100 data subjects. During its investigation, the DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data. This failure to implement protective measures permitted the data breaches to occur.
Décision officielle
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)