The National Supervisory Authority finalized in February this year an investigation at the controller Tinmar Energy SA within which the breach of the provisions of Article 32 paragraph (1) letter b) and paragraph (2) of the General Data protection Regulation was found.

Therefore, the company Tinmar Energy SA was sanctioned with fine in amount of Lei 14,702.1, the equivalent of Eur 3,000.

The investigation was started following the submission by the controller of a data security breach notification based on the General Data Protection Regulation.

Within the investigation performed it was found that the breach of the personal data security was performed through the unauthorized access of the e-mail server of Tinmar Energy SA, which led to the access to certain personal data, such as: first name, last name, e-mail, PIN, telephone number and domicile addresses.

Therefore, the controller Tinmar Energy SA was sanctioned with fine for the breach of the provisions of Article 32 paragraph (1) letter b) and paragraph (2) of the General Data Protection Regulation, given that it did not implement adequate technical and organizational measures for ensuring a level of security corresponding to the risk of the processing.

Legal and Communication Department

A.N.S.P.D.C.P.