Kredyt Inkaso Investments RO S.A: Insufficient legal basis for data processing
€5,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Content
The Romanian DPA has fined Kredyt Inkaso Investments RO S.A. EUR 5,000. A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract. In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.
GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 33 GDPR
Industry: Finance, Insurance and Consulting