Romania

Valoris Center S.R.L.

2,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2021-11-26.

Rank · Sector

#428

of 599 in Industry and Commerce

Rank · Romania

#179

of 285

Rank · All fines

#2,280

of 3,059

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2021-11-26
Controller / Processor: Valoris Center S.R.L.
Sector: Industry and Commerce
Quoted Articles: Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA (ANSPDCP) has imposed a fine of EUR 2,000 on Valoris Center S.R.L.. The controller notified the DPA of a data breach pursuant to Art. 33 GDPR. A call center employee of the controller had accidentally sent a customer an Excel file containing data from other customers of the controller. In the course of the investigation, it was determined that this breach resulted in the unauthorized disclosure of or access to personal data such as email address, username, user ID, phone number, customer name, customer code, customer PIN, with a total of 11169 natural persons affected by the incident. The DPA found that the controller had failed to implement technical and organizational measures to ensure a level of security appropriate to the risk to data subjects.

Open original source Links to the regulator's original publication or another source.