ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.

Summary

Romania's data protection authority (ANSPDCP) has fined AMATO BESTSELLER S.R.L. €54,300 for multiple GDPR and ePrivacy Directive violations. The company failed to implement adequate security measures, allowing former employees access to sensitive personal data. Additionally, they engaged in excessive data processing, provided incomplete information to data subjects, and used automated dialing systems for commercial communications without prior consent.

Full text

Help ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 13:55, 14 August 2026 view sourceLh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators6 edits Tag: Decisions [1.0] Latest revision as of 15:45, 18 August 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators6 editsTag: Visual edit Line 100: Line 100: }}}} The DPA imposed a 54,300 fine to a controller for violations of Article 32(4), Article 14 and Article 5(1)(c) in conjunction with [[Article 9 GDPR|Article 9 GDPR]] and ePrivacy Directive.The DPA imposed a RON 285,395 (€54,300) fine on a wholesale company for, amongst others, failing to implement appropriate security measures, allowing former employees to access personal data as well as for unlawfully using automated dialing and communication systems to call a significant number of data subjects. == English Summary ==== English Summary == === Facts ====== Facts === A general wholesale/retail trade company (controller) failed to implement adequate technical and organisational measures, such as appropriate training of its employees, in order to secure personal data from unauthorized access. Subsequently, for a specific period of time, former and current employees were able to access personal data (first name, last name, phone number, the relationship between one data subject and another, occupation, marital status, a person’s classification within a specific social category, city of domicile/residence, income data, family data, and health data/special categories of personal data) of a considerable amount of data subjects. The controller did not provide accurate and complete information to the data subjects and engaged in excessive data processing. Additionally, the controller sent commercial communications using automated dialing and communication systems that do not require human intervention, by dialing the telephone number and conducting conversations with a significant number of data subjects, without the data subjects having given their prior express consent to receive such communications. A general wholesale/retail trade company (controller) failed to implement adequate technical and organisational measures, such as appropriate training of its employees, in order to secure personal data from unauthorized access. Subsequently, for a specific period of time, former and current employees were able to access personal data (first name, last name, phone number, the relationship between one data subject and another, occupation, marital status, a person’s classification within a specific social category, city of domicile/residence, income data, family data, and health data/special categories of personal data) of a considerable amount of data subjects. The controller did not provide accurate and complete information to the data subjects and engaged in excessive data processing. Additionally, the controller sent commercial communications using automated dialing and communication systems that do not require human intervention, by dialing the telephone number and conducting conversations with a significant number of data subjects, without the data subjects having given their prior express consent to receive such communications. === Holding ====== Holding === The DPA held that the data controller violated [[Article 32 GDPR|Article 32(4) GDPR]] by failing to prevent unauthorized access of personal data to current and former employees of the data controller. The data controller violated [[Article 14 GDPR|Article 14 GDPR]] by failing to provide accurate and complete information to the data subjects. The excessive data processing (including special categories of data and health data), without ensuring that such processing was adequate, relevant, and limited to what is necessary in relation to the purposes for which the data were processed amounted to a violation of the data minimisation principle under Article 5(1)(c) in conjunction with [[Article 9 GDPR|Article 9 GDPR]]. Additionally, the DPA held that commercial communications using automated dialing and communication systems that do not require human intervention by dialing the telephone number and conducting conversations with a significant number of data subjects, without the data subjects having given their prior express consent to receive such communications, constitutes a violation of Article 12(1) of Law 506/2004, the Romanian law implementing the ePrivacy Directive.The DPA held that the data controller violated [[Article 32 GDPR|Article 32(4) GDPR]] by failing to prevent unauthorized access of personal data to current and former employees of the data controller. The data controller violated [[Article 14 GDPR]] by failing to provide accurate and complete information to the data subjects. The excessive data processing (including special categories of data and health data), without ensuring that such processing was adequate, relevant, and limited to what is necessary in relation to the purposes for which the data were processed amounted to a violation of the data minimisation principle under Article 5(1)(c) in conjunction with [[Article 9 GDPR]]. Additionally, the DPA held that commercial communications using automated dialing and communication systems that do not require human intervention by dialing the telephone number and conducting conversations with a significant number of data subjects, without the data subjects having given their prior express consent to receive such communications, constitutes a violation of Article 12(1) of Law 506/2004, the Romanian law implementing the ePrivacy Directive. The DPA imposed on the controller to include in all applicable work procedures/policies clear instructions regarding the flow of personal data within the controller’s organisation and the flow of documents containing personal data, specify differentiated employee access to certain activities involving personal data, as well as provide periodic training to employees and other natural or legal persons who process personal data. Moreover, the DPA imposed fines totalling Romania RON 285,395 (€54,300).The DPA imposed on the controller to include in all applicable work procedures/policies clear instructions regarding the flow of personal data within the controller’s organisation and the flow of documents containing personal data, specify differentiated employee access to certain activities involving personal data, as well as provide periodic training to employees and other natural or legal persons who process personal data. Moreover, the DPA imposed fines totalling Romania RON 285,395 (€54,300). Latest revision as of 15:45, 18 August 2026 ANSPDCP - AMATO BESTSELLER S.R.L. Authority: ANSPDCP (Romania) Jurisdiction: Romania Relevant Law: Article 5(1)(c) GDPR Article 9 GDPR Article 32(4) GDPR Article 12 GDPR Article 14 GDPR Article 12(1) Law 506/2004 Type: Complaint Outcome: Upheld Started: Decided: Published: Fine: 285395.0 RON Parties: n/a National Case Number/Name: AMATO BESTSELLER S.R.L. European Case Law Identifier: n/a Appeal: n/a Original Language(s): Romanian Original Source: Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (in RO) Initial Contributor: n/a The DPA imposed a RON 285,395 (€54,300) fine on a wholesale company for, amongst others, failing to implement appropriate security measures, allowing former employees to access personal data as well as for unlawfully using automated dialing and communication systems to call a significant number of data subjects. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A general wholesale/retail trade company (controller) failed to implement adequate technical and organisational measures, such as appropriate training of its employees, in order

Entities