Romania

Romanian Post

2,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2022-11-07.

Rank · Sector

#150

of 167 in Transportation and Energy

Rank · Romania

#190

of 283

Rank · All fines

#2,325

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2022-11-07
Controller / Processor: Romanian Post
Sector: Transportation and Energy
Quoted Articles: Art. 32 (1) b), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 2,000 on the Romanian Post. The Post suffered a data breach where staff lost several mailings containing pension statements, employment certificates and death certificates. The incident affected 35 individuals (recipients).
The DPA found that the Post had failed to implement adequate technical and organizational measures to protect personal data that might have prevented such an incident.

Open original source Links to the regulator's original publication or another source.