On May 8, 2024, the National Supervisory Authority for Personal Data Processing (ANSPDCP) announced that it had imposed a fine of RON 24,856 (approx. $5,360) on Centrul Medical Unirea SRL (Centrul Medical Unirea) for violations of the General Data Protection Regulation (GDPR), following a data breach.

Background to the decision

The ANSPDCP initiated an investigation after receiving a notification from Centrul Medical Unirea of an unauthorized disclosure on the internet of the personal data of a significant number of data subjects (patients and employees).

Findings of the ANSPDCP

The ANSPDCP concluded that Centrul Medical Unirea did not implement adequate technical and organizational measures to ensure a level of confidentiality and security appropriate to the risk of the processing and did not take sufficient measures to ensure that any natural person acting under the authority of Centrul Medical Unirea and who has access to personal data only processes them at their request.

The ANSPDCP found that Centrul Medical Unirea acted in violation of Articles 32(1)(b), 32(2), and 32(4) of the GDPR.

Outcomes

In light of the above violations, the ANSPDCP imposed a fine of RON 24,856 (approx. $5,360) on Centrul Medical Unirea. In addition, the ANSPDCP ordered Centrul Medical Unirea to review and update the technical and organizational measures implemented as a result of the risk assessment, including periodic testing, evaluation, and assessment of the effectiveness of technical and organizational measures to guarantee the security of the processing carried out.

You can read the press release, only available in Romanian, here.