View source for ANSPDCP (Romania) - Fine against Societatea Civilă Profesională de Avocați „Sabou, Burz & Cuc”

== English Summary ==

=== Facts ===
A client of the “Sabou, Burz & Cuc" law firm filed a complaint with the Romanian DPA against the firm, claiming that it had posted a case file containing their personal data on an external WhatsApp group with other lawyers, without their consent. The DPA subsequently initiated an investigation on this matter.  

=== Holding ===
The DPA's investigation found that the case file which included the data subject's personal data  (including name, surname, home address, and information regarding a case pending before a court) was indeed shared on the external WhatsApp lawyer group, which contained 247 members. 

The DPA held that the data processing in this case was carried out without a valid legal basis, and that it was excessive, incompatible with the initial purpose of collection, and lacking the necessary technical and organisational measures meant to ensure data confidentiality, in breach of [[Article 6 GDPR|Articles 6]], [[Article 5 GDPR#1a|5(1)(a)]], [[Article 5 GDPR#1b|5(1)(b)]], [[Article 5 GDPR#1c|5(1)(c)]], [[Article 5 GDPR#1f|5(1)(f)]] and [[Article 5 GDPR#1|5(2) GDPR]].

Therefore, the DPA issued a fine of approximately €1000 (RON 4946) on the law firm. As corrective measures, the DPA ordered the firm to notify the members of the WhatsApp group about the unlawful disclosure, to request that the group administrator erase the case file, as well as to train its personnel in GDPR compliance and avoiding future unlawful data disclosures.