[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLE2j-uenIE2tRblNi4e9zZcB_QbMTAFv4U9u8idNsnA":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"5709a900-43fb-4780-9d01-d8cdc0ce3e5e","ANSPDCP (Romania) - 02\u002F07\u002F2026","anspdcp-romania-02-07-2026-4cfd60","Created page with \"{{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=02\u002F07\u002F2026 |ECLI= |Original_Source_Name_1=ANSPDCP |Original_Source_Link_1=https:\u002F\u002Fwww.dataprotection.ro\u002F?page=Comunicat_Presa_02_07_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language...\" New page {{DPAdecisionBOX |Jurisdiction=Romania |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoRO.jpg |DPA_Abbrevation=ANSPDCP |DPA_With_Country=ANSPDCP (Romania) |Case_Number_Name=02\u002F07\u002F2026 |ECLI= |Original_Source_Name_1=ANSPDCP |Original_Source_Link_1=https:\u002F\u002Fwww.dataprotection.ro\u002F?page=Comunicat_Presa_02_07_2026&lang=ro |Original_Source_Language_1=Romanian |Original_Source_Language__Code_1=RO |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started= |Date_Decided= |Date_Published=02.07.2026 |Year= |Fine=26,172 |Currency=RON |GDPR_Article_1=Article 32(1) GDPR |GDPR_Article_Link_1=Article 32 GDPR#1 |GDPR_Article_2=Article 32(2) GDPR |GDPR_Article_Link_2=Article 32 GDPR#2 |GDPR_Article_3=Article 32(4) GDPR |GDPR_Article_Link_3=Article 32 GDPR#4 |GDPR_Article_4= |GDPR_Article_Link_4= |GDPR_Article_5= |GDPR_Article_Link_5= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Banca Transilvania S.A |Party_Link_1= |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=ds | }} The DPA fined a bank RON 26,172 (€5,000) for failing to implement appropriate technical and organisational measures after an employee unlawfully accessed a customer’s account data for personal purposes. == English Summary == === Facts === The Romanian DPA (ANSPDCP) launched an investigation into a bank, Banca Transilvania S.A. (the controller), following a data subject’s complaint. The data subject claimed that their personal data associated with their bank account had been processed without their consent. During the investigation the DPA found that an employee of the controller had accessed the data subject's bank account statements without authorisation and outside the scope of their official duties, at the request of a third party. The personal data included the data subject’s surname, first name, IBAN, account type, client code, transaction data and account balances. === Holding === The DPA found that the controller had failed to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. It noted that the controller had not sufficiently ensured that employees acting under its authority and having access to customers’ personal data processed those data only on its instructions. It held that this failure resulted in the unauthorised access to the data subject’s personal data for personal purposes. The DPA therefore found that the controller infringed [[Article 32 GDPR#1|Article 32(1) GDPR]], [[Article 32 GDPR#2|Article 32(2) GDPR]] and [[Article 32 GDPR#4|Article 32(4) GDPR]] and imposed a fine of RON 26,172 (€5,000). Furthermore, the DPA ordered the controller to implement appropriate technical and organisational measures to prevent employees from unlawfully accessing personal data for personal purposes. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Romanian original. Please refer to the Romanian original for more details. 02\u002F07\u002F2026 Sanction for violation of the GDPR The National Supervisory Authority for Personal Data Processing completed, in June 2026, an investigation at the operator Banca Transilvania S.A. and found a violation of the provisions of art. 32 para. (1), (2) and (4) of Regulation (EU) 2016\u002F679. As such, the operator was sanctioned with a fine of 26,172 lei, equivalent to 5,000 euros. The investigation was initiated following a complaint from a natural person, a data subject, who claimed that his personal data associated with his bank account had been processed without his consent. During the investigation, it was found that an employee of the operator, at the request of a third party, accessed, outside of his\u002Fher job duties, account statements of the data subject in an unauthorized manner, affecting the following categories of personal data: name, surname, bank account number (IBAN), account type, client code, transaction data and account balance. As such, it was found that the operator did not implement technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing, in order to ensure that employees acting under its authority and having access to the personal data of the bank's customers only process them at its request, which led to unauthorized access, for personal purposes, to the data subject's data. Consequently, in relation to the criteria for individualizing the sanction provided for in art. 83 para. (2) of Regulation (EU) 2016\u002F679, the operator Banca Transilvania S.A. was fined for violating the provisions of art. 32 par. (1), (2) and (4) of Regulation (EU) 2016\u002F679. At the same time, pursuant to the provisions of art. 58 par. (2) letter b) of Regulation (EU) 2016\u002F679, the corrective measure was ordered against the operator to ensure compliance with Regulation (EU) 2016\u002F679 of the personal data processing operations, by implementing appropriate technical and organizational measures, so as to avoid illegal access, in the personal interest of employees, to the personal data of individuals whose data the operator processes. The operator paid the contravention fine imposed by ANSPDCP. Legal and Communication Department A.N.S.P.D.C.P","The Romanian DPA (ANSPDCP) has fined Banca Transilvania S.A. RON 26,172 (€5,000) for failing to implement adequate security measures. An employee unlawfully accessed a customer's bank account data for personal purposes at the request of a third party. The DPA found violations of Article 32 of the GDPR concerning appropriate technical and organizational measures.","Romanian DPA fines Banca Transilvania RON 26,172 for employee data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_02\u002F07\u002F2026&diff=52059&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-07-03T15:14:32+00:00","2026-07-03T16:00:16.518941+00:00",7,[17],{"name":18,"type":19},"Banca Transilvania S.A","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":128},[45,73,102],{"slug":46,"name":47,"problem":48,"products":49},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":46,"product_name":70,"url":71,"description":72},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":74,"name":75,"problem":76,"products":77},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":103,"name":104,"problem":105,"products":106},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":124,"product_name":125,"url":126,"description":127},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":145},"insider-misuse-of-customer-data-earns-romanian-bank-gdpr-fine","Insider Misuse of Customer Data Earns Romanian Bank GDPR Fine","A Banca Transilvania employee unlawfully accessed a customer's bank account data at the request of a third party, representing a classic insider threat enabled by inadequate access controls. The root cause is the bank's failure to implement sufficient technical and organizational measures to restrict, monitor, and detect unauthorized internal access to sensitive customer data, as required by GDPR Article 32. This matters because financial institutions hold highly sensitive personal and financial data, and even a single employee's unauthorized access can constitute a serious data breach with real harm to the affected customer. Regulators expect banks to enforce the principle of least privilege and maintain robust audit trails that would both deter and detect such insider misuse.",[134,135,136,137,138,139,140,141,142,143,144],"GDPR Article 32 – Security of processing","GDPR Article 5(1)(f) – Integrity and confidentiality principle","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4 – System Monitoring","ISO\u002FIEC 27001:2022 Annex A 8.2 – Privileged Access Rights","ISO\u002FIEC 27001:2022 Annex A 8.15 – Logging","ITIL 4 – Information Security Management Practice",{}]