Romania

Kredyt Inkaso Investments RO S.A

5,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2022-05-18.

Rank · Sector

#231

of 323 in Finance, Insurance and Consulting

Rank · Romania

#72

of 285

Rank · All fines

#1,762

of 3,059

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2022-05-18
Controller / Processor: Kredyt Inkaso Investments RO S.A
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 33 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Romanian DPA has fined Kredyt Inkaso Investments RO S.A.
EUR 5,000.

A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract.

In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.

Open original source Links to the regulator's original publication or another source.