Search Privacy Fines

Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 13 (1), (2) GDPR, Art. 24 GDPR, Art. 25 GDPR

The fine was issued because, in April 2019, the company hadn’t taken the necessary measures to ensure the integrity and confidentiality of information (as per Art. 5 para. 1 lit. f GDPR) when it disposed of documents that contained personal information of two clients. We should mention that the documents were simply disposed of in the general waste recycling system where they were found by a neighbor.

Articles: Art. 5 GDPR, Art. 32 GDPR

Articles: Art. 5 GDPR, Art. 32 GDPR

Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR

The Company experienced the data breach when it transferred the personal data of 18,610 customers to a partner organization. In doing so, the company allowed anyone to access the personal data because the “Anonymous Authentication” function was switched on. The data breach was active for two years.

Articles: Data Protection Act 2018

Because of insufficient data security mechanisms, a digital publication accidentally disclosed personal health data related to several subjects.

Articles: Art. 32 GDPR

Two companies working in finances didn’t follow the procedure when disposing of personal data.

Articles: Art. 32 GDPR

Articles: Art. 5 GDPR, Art. 6 GDPR

The Romanian branch of ING Bank N.V. Amsterdam was fined with €80,000 due to not respecting data protection principles (privacy by design și privacy by default) by not implementing adequate technical measures to ensure the protection of personal data. As a consequence of this, a total of 225,525 had their transactions doubled on debit card payments during the period of 8-10 October 2018.This is one of the bigger fines in Romania, but it’s interesting to note that for similar offenses in other countries fines of over several millions of Euros are usually awarded. This denotes again the fact that different countries have different approaches to GDPR enforcement.

Articles: Art. 25 GDPR

Articles: Data Protection Act 2018

Articles: Art. 32 GDPR

Articles: Art. 5 (1) f) GDPR, Art. 32 (1) GDPR

Articles: Art. 32 GDPR

Articles: Art. 25 GDPR

In a digital publication, health data was accidentally published due to inadequate internal control mechanisms.Due to inadequate internal control mechanisms, health data was made public by a digital publication.

Articles: Art. 32 GDPR

Articles: Art. 6 GDPR

Articles: Art. 32 GDPR

Articles: Art. 33 (1) GDPR, Art. 34 (1) GDPR

Vodafone España has signed a contract regarding the transfer of a phone subscription with a third party person without the account holder’s knowledge or permission. The account holder received an email from the third party regarding the purchase that was made in his name.

Articles: Art. 5 GDPR, Art. 6 GDPR

The company was fined because it processed personal data in regards to a gas contract without the applicants’ consent. The investigation revealed that the applicant received an invoice for the supplying of natural gas, a contract which they didn’t sign. EDP Comercializadora argued that since the applicant had a contract with another gas company with which EDP Comercializadora had a collaboration agreement, it was justified to process the personal data of the respective individuals. The AEPD, however, ruled that the company was required to receive permission directly from the affected individuals to process personal data.

Articles: Art. 6 GDPR

Articles: Art. 6 GDPR

A former customer of the company continued to receive invoice notices even after the contractual obligation between the two parties has ended. The company indicated a technical error for the issuing of the unsolicited notices.

Articles: Art. 5 GDPR, Art. 6 GDPR

Articles: Art. 5 (1) a), b), e) GDPR, Art. 12 (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSI

Articles: Art. 15 GDPR

The company was fined because it processed personal data such as name, tax identification number, address and phone number without the consent of the affected individuals.

Articles: Art. 6 GDPR