The National Supervisory Authority for Personal Data Processing finalized in December last year an investigation at the controller TECHNINK LEB SRL and found the breach of the provisions of Article 32 paragraph (1) letters a), b) and d), in conjunction with Article 32 paragraph (2) from the General Data Protection Regulation (GDPR).

Therefore, the controller was sanctioned with fine in amount of Lei 14,904.30, the equivalent of EUR 3,000.

The investigation was started following the submission by the controller of a personal data security breach notification based on the General Data Protection Regulation.

The breach of the data security took place following the unauthorized disclosure of the personal data (id, address, first name, last name, e-mail address, company, sales, active, subscriber to the informative bulletin, registration and last visit) for a significant number of clients, these data being accessible on the website of the controller.

Within the investigation it was found that the controller did not implement adequate technical and organizational measures in order to ensure a level of security corresponding to the risk presented by the processing, generated specifically by the unauthorized disclosure or unauthorized access to the personal data stored.

Also, based on Article 58 paragraph (2) letter d) from the GDPR, the following corrective measures were ordered against TECHNINK LEB SRL:

The implementation of a plan that shall include a testing, evaluation and periodical assessment process of all systems and the subsequent amendments of the latter performed by the controller or services providers (processors), specifically on the website managed by the controller;
The drafting and implementation of some complexity procedures for the passwords, specifically for the administrator accounts, that shall contain specific requirements such as: minimum length of the password, the variety of the characters, its expiry period, as well as the impossibility to re-use a previously registered password.

Legal and Communication Department

A.N.S.P.D.C.P.