Romanian Retailer Fined €54,300 for Allowing Ex-Employee Data Access and Consent Failures
Written by AI from the linked story. Not reviewed by an editor. How this works
AMATO BESTSELLER S.R.L. failed on multiple fronts: former employees retained active access to personal data after leaving the organization, indicating a broken or absent offboarding process for revoking credentials and permissions. The company also processed data beyond its stated purpose, failed to properly inform data subjects of their rights, and conducted automated marketing calls without obtaining prior consent — all clear GDPR and ePrivacy violations. These failures demonstrate a systemic lack of data governance, not just isolated technical oversights. The resulting €54,300 fine highlights that regulators treat access control lapses and consent failures as serious, financially punishable risks rather than administrative technicalities.
Tactical Insight
Immediate actions
- Revoke all system access for departing employees on their last working day using a formal, documented offboarding checklist.
- Audit current user accounts to identify and disable any stale or orphaned accounts belonging to former staff.
- Review all marketing communication lists to verify that valid, documented consent exists for each contact before sending.
Long-term improvements
- Implement a role-based access control (RBAC) model with least-privilege principles to limit data exposure to only what is necessary per role.
- Establish a formal data minimization and retention policy ensuring personal data is not processed beyond its original, documented purpose.
- Deploy an identity lifecycle management solution that automatically triggers access revocation workflows upon HR offboarding events.
Detection & compliance measures
- Conduct quarterly access reviews to validate that active permissions align with current employee roles and responsibilities.
- Implement consent management tooling that logs, timestamps, and stores proof of consent for all marketing communications.
- Schedule annual GDPR compliance audits covering data subject information notices, processing activities, and ePrivacy obligations.