ANSPDCP (Romania) - 07.12.2023
| ANSPDCP - 07.12.2023 | |
|---|---|
 | |
| Authority: | ANSPDCP (Romania) |
| Jurisdiction: | Romania |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 32 GDPR Article 33(1) GDPR |
| Type: | Complaint |
| Outcome: | Other Outcome |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | 24000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 07.12.2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Romanian |
| Original Source: | Romanian DPA (in RO) |
| Initial Contributor: | maxinescu |
Hora Credit IFN SA, a non-financial institution, was fined €24,000 following a data breach. The DPA found a violation of Article 32 GDPR, among others, since the institution sent documents containing the personal data of another client to the wrongful recipient.
English Summary
Facts
The Romanian DPA initiated an investigation regarding the practices of the non-financial institution Hora Credit IFN SA (the controller).
The investigation followed a complaint brought by a complainant, a client of the controller, claiming that the controller sent him by e-mail documents containing the personal data of another person, another client of the same controller.
Although the person receiving the e-mails notified the controller about the error that occurred, the controller did not remedy the respective error and continued to send messages to the wrongful recipient using the same e-mail address.
Holding
During the investigation, the Romanian DPA found that the controller failed to present evidence regarding the communication of the source of collection of personal data in its response to the petitioner’s right of access request, in accordance with Article 15(1) GDPR and also failed to observe the timeframe to answer to the request, as provided under Article 12 (3) and (4) GDPR.
Following the investigation, the DPA assessed that the controller did not adopt sufficient security measures in line with Article 32 GDPR to prevent unauthorized and accessible disclosure of the petitioner’s personal data to third parties. Furthermore, it was found that the controller did not notify the data breach to the DPA with the observance of Article 33(1) GDPR, respectively within 72 hours of having become aware of it.
Therefore, the DPA found the controller violated Article 32 GDPR, Article 33(1) GDPR, Article 15(1) GDPR and Article 12(3) and (4) GDPR and issued the controller a €24,000 fine.
The DPA also imposed the following corrective measures. Firstly, it requested the controller to ensure compliance with the GDPR and implement appropriate and effective security measures when dealing with data processing operations pertaining to the purpose of concluding and executing loan agreements, in order to respect professional secrecy and confidentiality of the personal data of the controller’s clients, as well as identify and limit the risks that may affect the data subjects. Secondly, the DPA asked the controller to contact the complainant and request the deletion of the personal information he received of the client. Additionally, it mandated the controller to implement an adequate internal policy for identifying risks, analyzing them and notifying the DPA in case of a data breach, in accordance with Article 33(1) GDPR. Lastly, the DPA requested the controller to inform its client of the breach of security of his data by transmitting them to the complainant erroneously.
Comment
Unfortunately, the Romanian DPA does not publish its full decisions.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details.
https://www.dataprotection.ro/?page=Comunicat_Presa_07_12_2023&lang=ro
