Romania

Kredyt Inkaso Investments RO S.A

5,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2022-05-18.

Rank · Sector

#230

of 322 in Finance, Insurance and Consulting

Rank · Romania

#72

of 283

Rank · All fines

#1,757

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2022-05-18
Controller / Processor: Kredyt Inkaso Investments RO S.A
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 33 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Romanian DPA has fined Kredyt Inkaso Investments RO S.A.
EUR 5,000.

A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract.

In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.

Open original source Links to the regulator's original publication or another source.