Banca Comercială Română SA
Insufficient technical and organisational measures to ensure information security
Дата принятия решения
19 сентября 2022 г.
Авторитет
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
RO
Сектор
Finance, Insurance and Consulting
Страна
RO
Закон
GDPRСтатус
FINALОписание
The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA. The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to an error in the IT application of the controller, emails containing personal data of customers were sent to the wrong recipients. This data breach resulted in the unauthorized disclosure of and access to certain personal data such as first and last name, home address, phone number, email address, and financial information. The incident affected 564 individuals. The DPA found that the bank had failed to take appropriate technical and organizational measures to ensure a level of security commensurate with the processing risk.