Romania

NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.

1,500 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2023-05-12.

Rank · Sector

#296

of 322 in Finance, Insurance and Consulting

Rank · Romania

#225

of 283

Rank · All fines

#2,517

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2023-05-12
Controller / Processor: NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 1,500 on the insurance company NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.. The controller had notified the authority of a data breach pursuant to Art. 33 GDPR. The controller had made a number of technical changes to its systems that allowed some website visitors to access personal data of other individuals. This led to the unauthorized access of personal data such as name, ID card number, email, etc. of two individuals. During its investigation, the DPA found that the controller had failed to take appropriate technical and organizational measures to protect personal data, which facilitated such an incident.

Open original source Links to the regulator's original publication or another source.