Details:
| Summary | The Romanian DPA has imposed a fine of EUR 2,000 on Kaufland România SCS. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR.
An employee who processed a complaint had not followed the internal procedure for handling complaints, allowing a security guard to view and misuse the complainant’s data. In addition, the controller had mistakenly forwarded the data in a customer order form to an unauthorized third party. This led to the disclosure of personal data (first name, last name, e-mail address, telephone number) of the affected Kaufland customer. For this reason, the DPA found that the controller had not taken appropriate technical and organizational measures to ensure the protection and security of personal data. |
| Link: | link |
| Related articles: | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR |
| Type: | Insufficient technical and organisational measures to ensure information security |
| Fine: | EUR 2,000 |
| Sector | Industry and Commerce |
All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/