ANSPDCP (Romania) - 02/07/2026

A Banca Transilvania employee unlawfully accessed a customer's bank account data at the request of a third party, representing a classic insider threat enabled by inadequate access controls. The root cause is the bank's failure to implement sufficient technical and organizational measures to restrict, monitor, and detect unauthorized internal access to sensitive customer data, as required by GDPR Article 32. This matters because financial institutions hold highly sensitive personal and financial data, and even a single employee's unauthorized access can constitute a serious data breach with real harm to the affected customer. Regulators expect banks to enforce the principle of least privilege and maintain robust audit trails that would both deter and detect such insider misuse.