ANSPDCP (Romania) - 06.03.2023
| ANSPDCP - 06.03.2023 | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 32 GDPR Article 83 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | |
| Published: | 06.03.2023 |
| Fine: | 3,000 EUR |
| Parties: | Finopro IFN Integral Collection |
| National Case Number/Name: | 06.03.2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Romanian |
| Original Source: | ANSPDCP (in RO) |
| Initial Contributor: | ls |
The Romanian DPA imposed a €2,250 and a €3,000 fines to companies who suffered ransomware attacks, which implied data breaches because they did not ensure a sufficient level of security.
English Summary
Facts
Two companies: Finopro IFN and Integral Collection were victims of ransomware attacks. This implied that data they possessed (from ID cards, phone numbers, account statements...) were accessed without authorization and their security was compromised.
The companies notified the breaches to the DPA, which then opened two investigations.
Holding
The DPA found that both companies had violated Article 32(1)b and c and 32(2) GDPR because they had not implemented adequate technical and organizational measures to ensure a sufficient level of security.
In accordance with Article 83, the DPA therefore imposed a fine of lei11,023.42 (approximately €2,250) on Finopro IFN and lei14,697.90 (approximately €3,000) on Integral Collection.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
06.03.2023 Sanctions for GDPR violations In February of the current year, the National Supervisory Authority completed two investigations at the operators of Finopro IFN SA and Integral Collection SRL and found a violation of the provisions of art. 32 para. (1) lit. b) and c) and para. (2) of the General Data Protection Regulation (RGPD). As such, the operators were sanctioned as follows: Finopro IFN SA with a fine of 11,023.42 lei, the equivalent of 2,250 EURO; Integral Collection SRL with a fine of 14,697.90 lei, the equivalent of 3,000 EURO. The investigations were started as a result of the transmission by the operators of some notifications of breaches of the security of personal data under the RGPD. During the investigations carried out, it was found that the breach of data processing security occurred as a result of ransomware attacks, a situation that significantly led to unauthorized access and the loss of the integrity and availability of personal data (such as identification data, data from identity cards, addresses, telephone numbers, account statements). As such, taking into account the measures announced by these operators to remedy the situation, in relation to the criteria for individualizing the sanctions provided for in art. 83 of the RGPD, the penalty for violating the provisions of art. 32 para. (1) lit. b) and c) and para. (2) of the GDPR, as they have not implemented adequate technical and organizational measures to ensure a level of security appropriate to the processing risk, including the ability to ensure the confidentiality, integrity, availability and continued resilience of the processing systems and services. Legal and Communication Department A.N.S.P.D.C.P.
