# Actamedica SRL: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Date: 2021-08-24
- Original: https://www.enforcementtracker.com/ETid-816
- Canonical: https://overview.legal/posts/46931
- Topics: Data Breaches, Security, Healthcare, Controllers, Personal Data, Privacy by Design & Default, Processing Agreement, Supervisory Authorities, Processing, Data Controller

## Summary

The Romanian DPA (ANSPDCP) has fined Actamedica SRL EUR 3,000. The controller had informed a private individual about the loss of her biological samples and a sum of money sent via a courier service. When asked what personal data had been disclosed on this occasion and whether the ANSPDCP had been informed of this incident, the controller only provided the contact details of his lawyer and an e-mail address of the courier service to which the private individual could address her complaint. The A

## Full text

The Romanian DPA (ANSPDCP) has fined Actamedica SRL EUR 3,000. The controller had informed a private individual about the loss of her biological samples and a sum of money sent via a courier service. When asked what personal data had been disclosed on this occasion and whether the ANSPDCP had been informed of this incident, the controller only provided the contact details of his lawyer and an e-mail address of the courier service to which the private individual could address her complaint. The ANSPDCP found a breach of the controller's obligation to implement technical and organizational measures to ensure a level of protection appropriate to the risk to data subjects, as well as a breach of the controller's obligation to notify the ANSPDCP of the data breach.

GDPR Articles: Art. 28 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR
Industry: Health Care

---
Generated by overview.legal · https://overview.legal/posts/46931 · 2026-08-22