Enforcement · Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

S CNTAR TAROM SA (Airline): Insufficient technical and organisational measures to ensure information security

€20,000 Fine
S CNTAR TAROM SA (Airline)
ROMANIA
Art. 32 GDPR
Integrity and Confidentiality Principle Data Breaches Security Personal Data Supervisory Authorities Processing Supervision
Dec 4, 2019 Source

How it connects

Related across sources

Case Law Rotterdam Court: DPA did not err in finding ING contactless chip payments GDPR-compliant District Court Rotterdam Case Law SO Warszawa - III C 904/23 Regional Court in Warsaw Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance EDPB Annual Report 2023 EDPB Guidance Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria EDPB Case Law Judgment of the Court (Third Chamber) of 25 January 2024.#BL v MediaMarktSaturn Hagen-Iserlohn GmbH.#Request for a preliminary ruling from the Amtsgericht Hagen.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Interpretation of Articles 5, 24, 32 and 82 – Assessment of the validity of Article 82 – Inadmissibility of the request for an assessment of validity – Right to compensation for damage caused by Court of Justice of the European Union

Full text

The Romanian data protection authority imposed a sanction on an airline because it has not taken appropriate measures to ensure that any natural person acting under its supervision processes personal data in accordance with its instructions (Article 32(4) of the GDPR). This resulted in an employee having unauthorized access to the booking application and being able to photograph a list with the personal data of 22 passengers/customers to disclose this list on the Internet.

Industry: Transportation and Energy

Original document at the source www.dataprotection.ro

Similar Content