Romania

Valoris Center S.R.L.

2,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2021-11-26.

Rank · Sector

#427

of 597 in Industry and Commerce

Rank · Romania

#178

of 283

Rank · All fines

#2,274

of 3,050

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2021-11-26
Controller / Processor: Valoris Center S.R.L.
Sector: Industry and Commerce
Quoted Articles: Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA (ANSPDCP) has imposed a fine of EUR 2,000 on Valoris Center S.R.L.. The controller notified the DPA of a data breach pursuant to Art. 33 GDPR. A call center employee of the controller had accidentally sent a customer an Excel file containing data from other customers of the controller. In the course of the investigation, it was determined that this breach resulted in the unauthorized disclosure of or access to personal data such as email address, username, user ID, phone number, customer name, customer code, customer PIN, with a total of 11169 natural persons affected by the incident. The DPA found that the controller had failed to implement technical and organizational measures to ensure a level of security appropriate to the risk to data subjects.

Open original source Links to the regulator's original publication or another source.