The National Supervisory Authority for the Processing of Personal Data completed, in December 2024, an investigation at the operator SPEEH HIDROELECTRICA SA and found a violation of art. 25 para. (1) and para. (2) of Regulation (EU) 2016/679.
As such, the operator was fined 74,562 Lei (equivalent to 15,000 Euros).
The investigation was initiated following the transmission by the operator SPEEH HIDROELECTRICA SA of a notification of a personal data breach, according to the provisions of art. 33 of Regulation (EU) 2016/679.
During the investigation, it was found that the personal data security breach occurred within and at the time of launching the operator’s application, as a result of a technical error and the failure to sufficiently test it in a test environment, which would simulate the real usage environment in all processes and interactions with other applications used by the operator.
This situation led to the loss of integrity and availability of personal data, respectively to unauthorized disclosure and/or unauthorized access to personal data belonging to a significant number of data subjects.
Consequently, since the operator did not process personal data in a manner that ensures adequate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures, it was fined for violating the provisions of art. 25 para. (1) and para. (2) of Regulation (EU) 2016/679.
At the same time, the operator was ordered to take the corrective measure of technical and procedural implementation of a test plan in the test environment, which would simulate the real production scenario in all plausible situations in the production environment, prior to the launch into production of all components/applications that are intended to be introduced within the activities that include personal data processing.
The operator paid the established misdemeanor fine.
https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_31.01.2025_1&lang=ro