Full text
October 30, 2026 Penalty for GDPR Violation The National Supervisory Authority for Personal Data Processing has concluded an investigation into the data controller Auchan Romania S.A. and found a violation of the provisions of Article 32(1)(b) and (2) (2) of Regulation (EU) 2016/679. Accordingly, the data controller was fined 41,908 lei (equivalent to 8,000 euros). The investigation was initiated following the submission by the data controller, Auchan Romania S.A., of a notification regarding a personal data breach, in accordance with the provisions of Article 33 of Regulation (EU) 2016/679. The investigation found that the data security breach occurred as a result of a cyberattack on an administrator account of one of the operator’s security systems. This led to the unlawful access to and disclosure of the personal data of a significant number of data subjects (internal users), including: username, last name, first name, email address, and password. Furthermore, during the investigation, it was found that, at the time of the cyberattack, the operator had not implemented security measures with specific requirements regarding secure access to the network storage device that would mitigate the risk of unauthorized access to the aforementioned personal data. Consequently, it was found that Auchan Romania S.A. had not implemented adequate technical and organizational measures to ensure a level of security appropriate to the risk of processing, including the ability to ensure the confidentiality of processing systems and services. This situation led to the unauthorized disclosure of, or unauthorized access by a third party to, the personal data held by the controller, thereby violating the provisions of Article 32(1)(b) and (2) (2) of Regulation (EU) 2016/679. Pursuant to Article 58(2)(d) of Regulation (EU) 2016/679, a corrective measure was also ordered requiring the technical and organizational implementation of access rules so that access to all of the controller’s IT equipment is permitted exclusively from the company’s internal network, and in cases where external access is deemed necessary, it must be possible to access the system at least through the simultaneous use of a VPN and multi-factor authentication (MFA). Legal and Communications Department A.N.S.P.D.C.P