Actamedica SRL
Insufficient technical and organisational measures to ensure information security
决定日期
2021年8月24日
权力
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
RO
部门
Health Care
国家
RO
法律
GDPR现状
FINAL说明
The Romanian DPA (ANSPDCP) has fined Actamedica SRL EUR 3,000. The controller had informed a private individual about the loss of her biological samples and a sum of money sent via a courier service. When asked what personal data had been disclosed on this occasion and whether the ANSPDCP had been informed of this incident, the controller only provided the contact details of his lawyer and an e-mail address of the courier service to which the private individual could address her complaint. The ANSPDCP found a breach of the controller's obligation to implement technical and organizational measures to ensure a level of protection appropriate to the risk to data subjects, as well as a breach of the controller's obligation to notify the ANSPDCP of the data breach.