Enforcement · Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

S.P.E.E.H. Hidroelectrica S.A.: Insufficient technical and organisational measures to ensure information security

€5,000 Fine
S.P.E.E.H. Hidroelectrica S.A.
ROMANIA
Art. 32 GDPR
Data Breaches Security IP Address Controllers Processing Agreement Privacy by Design & Default Human Resources Personal Data
Nov 1, 2021 Source

How it connects

Related across sources

Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Case Law HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) Hof van Justitie EU Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB

Full text

The Romanian DPA (ANSPDCP) has imposed a fine of EUR 5,000 on S.P.E.H. Hidroelectrica S.A.. The controller had notified the DPA of several breaches of personal data protection under Art. 33 of the GDPR. The data breach led to the data of 325 individuals being accessed unlawfully or passed on to the wrong recipients. The DPA considered this to be a breach by the controller of its obligation under Art. 32 (1) b), (2) GDPR to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk represented by the processing. In addition, the DPA found that the controller had processed personal data of three customers after they had exercised their right to erase their data and revoked their consent to the processing. The processing was therefore carried out without a valid legal basis. The DPA imposed a fine of EUR 5,000 for a breach of Art. 32 (1) b), (2) GDPR. For a violation of Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, the DPA further issued a warning.

Industry: Transportation and Energy

Original document at the source www.dataprotection.ro

Similar Content