Sanction RGPD Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — Valoris Center S.R.L. : 2 k€ (2021)
- Autorité de contrôle
- Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Pays
- Roumanie
- Entreprise / secteur
- Valoris Center S.R.L.
- Montant de l'amende
- 2 k€
- Date de la décision
- 26 novembre 2021
- Fondement juridique
- Art. 29, Art. 32 (1) b), Art. 32 (4)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Romanian DPA (ANSPDCP) has imposed a fine of EUR 2,000 on Valoris Center S.R.L.. The controller notified the DPA of a data breach pursuant to Art. 33 GDPR. A call center employee of the controller had accidentally sent a customer an Excel file containing data from other customers of the controller. In the course of the investigation, it was determined that this breach resulted in the unauthorized disclosure of or access to personal data such as email address, username, user ID, phone number, customer name, customer code, customer PIN, with a total of 11169 natural persons affected by the incident. The DPA found that the controller had failed to implement technical and organizational measures to ensure a level of security appropriate to the risk to data subjects.
Décision officielle
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)