The National Supervisory Authority for Personal Data Processing, completed, in November 2025, an investigation at the controller Compania de Apă Oltenia S.A. and found a violation of the provisions of Article 29 and Article 32 paragraph (4) of Regulation (EU) 2016/679.

As such, the controller was sanctioned with a fine of 5,084 lei, the equivalent to 1,000 euros, according to the NBR exchange rate on the date of application of the sanction.

The investigation conducted at Compania de Apa Oltenia S.A. was initiated following the receipt of a complaint from a data subject regarding the violation of data protection legislation, in terms of disclosing her personal data on a social network, by an employee of the controller.

During the investigation, it was found that the controller did not adopt sufficient security measures to protect the personal data of its customers, which resulted from the unauthorized disclosure of the personal data of the data subject related to her patrimonial and financial situation in relation to the controller, on a social network, by an employee of the latter, who, by virtue of her position, should have acted with greater diligence and responsibility regarding the processing of the personal data of the controller’s customers, under conditions of confidentiality.

At the same time, the National Supervisory Authority also applied the corrective measure by which it was ordered to the controller to ensure compliance with Regulation (EU) 2016/679 of the personal data processing operations, by adopting the necessary technical and organizational measures, including in terms of regular and appropriate training of persons who have access to personal data to process them only at the request of the controller or pursuant to legal obligations, in accordance with Articles 24, 29 and 32 of the Regulation, with the appropriate involvement of the data protection officer.

Legal and Communication Department

A.N.S.P.D.C.P