Romania

Banca Comercială Română SA

2,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2022-09-19.

Rank · Sector

#277

of 322 in Finance, Insurance and Consulting

Rank · Romania

#187

of 283

Rank · All fines

#2,318

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2022-09-19
Controller / Processor: Banca Comercială Română SA
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 25 (1) GDPR, Art. 32 (1) b), d), e) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA.

The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR.

Due to an error in the IT application of the controller, emails containing personal data of customers were sent to the wrong recipients.
This data breach resulted in the unauthorized disclosure of and access to certain personal data such as first and last name, home address, phone number, email address, and financial information. The incident affected 564 individuals.

The DPA found that the bank had failed to take appropriate technical and organizational measures to ensure a level of security commensurate with the processing risk.

Open original source Links to the regulator's original publication or another source.