# Kaufland Romania SCS: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
- Date: 2022-12-27
- Original: https://www.enforcementtracker.com/ETid-1540
- Canonical: https://overview.legal/posts/47655
- Topics: Data Breaches, Video Surveillance, Security, Processing Agreement, Controllers, Privacy by Design & Default, Personal Data, Processing, Law Enforcement, Supervisory Authorities

## Summary

The Romanian DPA has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The controller had reported a data breach to the DPA according to Art. 33 GDPR. An employee had taken pictures of the CCTV recordings with their cell phone and transmitted them to a third party. The third party then published the images on which two people and a license plate could be identified on the website of a local newspaper. The DPA found that the controller had failed to implement adequate technical and organizatio

## Full text

The Romanian DPA has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The controller had reported a data breach to the DPA according to Art. 33 GDPR. An employee had taken pictures of the CCTV recordings with their cell phone and transmitted them to a third party. The third party then published the images on which two people and a license plate could be identified on the website of a local newspaper. The DPA found that the controller had failed to implement adequate technical and organizational measures to protect personal data.

GDPR Articles: Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/47655 · 2026-08-22