Details:

Summary The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA.

The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR.

Due to an error in the IT application of the controller, emails containing personal data of customers were sent to the wrong recipients.
This data breach resulted in the unauthorized disclosure of and access to certain personal data such as first and last name, home address, phone number, email address, and financial information. The incident affected 564 individuals.

The DPA found that the bank had failed to take appropriate technical and organizational measures to ensure a level of security commensurate with the processing risk.
Link: link
Related articles:  Art. 25 (1) GDPR, Art. 32 (1) b), d), e) GDPR
Type: Insufficient technical and organisational measures to ensure information security
Fine: EUR 2,000
Sector Finance, Insurance and Consulting

 

All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/

Tags: case law