The National Supervisory Authority for Personal Data Processing has closed two investigations on the Rețele Electrice Muntenia SA and Rețele Electrice Dobrogea SA data controllers and found a breach of the provisions of Article 32 (1) (b) and (d) and Article 32 (2) of Regulation (EU) 2016/679.

In conclusion, the controllers were sanctioned with fines for the breach of the aforementioned provisions as follows:

- Rețele Electrice Muntenia SA – a fine in the amount of Lei 14,928.60 (the equivalent of EUR 3,000);

- Rețele Electrice Dobrogea SA – a fine in the amount of Lei 4.976,20 (the equivalent of EUR 1,000).

The investigations were launched following complaints indicating that a user connected to their account on the common website of the two controllers, www.e.distributie.com, could view the personal data of other clients of the controllers.

At the same time, the controllers Rețele Electrice Muntenia SA and Rețele Electrice Dobrogea SA have submitted to our institution notifications of data breach regarding the issues raised.

During the investigations it was found that the controllers have not implemented appropriate technical and organizational measures to ensure a level of security suitable to the risk of processing, including the capacity to ensure the privacy of processing systems and services, which lead to an unauthorised access of a third-party to personal data (surname, name, street, city, personal identity number) of several clients of the controllers, thus breaching the provisions of Article 32 (1) (b) and (d) and Article 32 (2) of Regulation (EU) 2016/679.

At the same time, according to the provisions of Article 58 (2) of Regulation (EU) 2016/679, Rețele Electrice Dobrogea SA and Rețele Electrice Muntenia SA were also imposed the corrective measure to implement periodic tests for online services offered to customers on the new web portal owned by these operators.

Legal and Communication Department

A.N.S.P.D.C.P.