The National Supervisory Authority for Personal Data Processing completed an investigation into SSG SELECT SOLUTIONS S.R.L. in April 2026 and found infringements of Article 29, Article 32(1)(b), Article 32(2), and Article 32(4) of Regulation (EU) 2016/679.

As a result, SSG SELECT SOLUTIONS S.R.L. was fined with 10,200 lei, equivalent to 2,000 euros.

The investigation was initiated following the submission by the data controller, Kaufland România SCS, of a personal data breach notification pursuant to Article 33 of Regulation (EU) 2016/679, concerning a security incident reported by its processor, SSG SELECT SOLUTIONS S.R.L.

During the investigation, it was established that an employee of SSG SELECT SOLUTIONS S.R.L. allowed an unauthorized third party to enter the video surveillance monitoring room located inside the store.

As a result, the third party accessed, recorded, and disseminated video footage from inside the store by publishing it online on a social media platform. This constituted a breach of the confidentiality of the personal data of several individuals.

Accordingly, it was found that SSG SELECT SOLUTIONS S.R.L. had failed to take appropriate measures to ensure that any natural person acting under its authority and having access to personal data processed such data only on its instructions. Furthermore, the company had failed to implement appropriate technical and organizational measures to ensure a level of confidentiality and security appropriate to the risks associated with the processing.

In addition, pursuant to Article 58(2)(d) of the Regulation, the processor was ordered the corrective measure to implement additional measures to control and monitor compliance with its internal working procedures, as well as with the instructions issued by the data controller, KAUFLAND ROMÂNIA SCS, in accordance with Article 28 of the GDPR.

The administrative fine imposed on the offender has been paid.

Legal and Communication Department

A.N.S.P.D.C.P.