Enforcement · Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Banca Transilvania SA: Insufficient technical and organisational measures to ensure information security

€100,000 Fine
Banca Transilvania SA
ROMANIA
Art. 5 GDPR Art. 32 GDPR
Integrity and Confidentiality Principle Data Breaches Security Social Media Professional Secrecy Processing Agreement IP Address Insurance
Dec 17, 2020 Source

How it connects

Related across sources

Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB News DeFine is a calculator for GDPR fines based on method of the EDPB Kromann Reumert Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News Danish SA Declares Use of Google Analytics Unlawful Without Supplementary Measures Datatilsynet

Full text

The Romanian DPA (ANSPDCP) fined Banca Transilvania SA EUR 100,000 for violations of Art. 5 (1) f) GDPR, Art. 32 (1) GDPR and Art. 32 (2) GDPR. It was found that the bank requested a declaration from a customer about the intended use of a certain amount of money wished to withdraw from its account. This statement was submitted to the bank online and forwarded to several employees of the bank. One employee photographed the declaration with his cell phone and spread it via WhatsApp. Subsequently, the document was posted on the social network Facebook and on a website. This situation led to the disclosure and unauthorized access of certain personal data concerning four data subjects, despite the Bank's commitment to respect the principle of integrity and confidentiality of personal data as required by Art. 5 (1) f) GDPR. The DPA notes that the occurred disclosure of the data also proves the ineffectiveness of the internal training of the Bank's employees regarding compliance with the standards for data protection. These trainings are, however, an integral part of the technical and organizational measures that the Bank was obliged to implement, Art. 32 GDPR.

Industry: Finance, Insurance and Consulting

Original document at the source www.dataprotection.ro

Similar Content