Romanian Retailer Fined €54K for GDPR Failures Including Unauthorized Employee Data Access
Written by AI from the linked story. Not reviewed by an editor. How this works
AMATO BESTSELLER S.R.L. failed to implement adequate technical and organizational security measures, allowing both current and former employees unauthorized access to sensitive personal data — a fundamental access control failure. Beyond the access breach, the company compounded its liability by processing data excessively beyond stated purposes, providing inaccurate information to data subjects, and sending marketing communications without valid consent. This case illustrates how multiple simultaneous GDPR violations significantly amplify regulatory penalties. It serves as a critical reminder that GDPR compliance is not a one-time checkbox but requires ongoing governance across access management, data minimization, transparency, and consent frameworks.
Tactical Insight
Immediate Actions
- Revoke all system and data access for departing employees on the same day of termination using a formal offboarding checklist.
- Conduct an immediate audit of who currently has access to personal data stores and remove any accounts that are excessive, stale, or no longer justified.
Data Governance & Compliance
- Implement a data minimization review to ensure only necessary personal data is collected and retained in line with GDPR Article 5(1)(c).
- Establish a valid consent management platform (CMP) to capture, record, and honor marketing consent before sending any commercial communications.
- Create and maintain accurate, up-to-date privacy notices so data subjects receive transparent information as required under GDPR Articles 13 and 14.
Long-Term Improvements
- Adopt role-based access control (RBAC) with the principle of least privilege to restrict personal data access to only those with a demonstrated business need.
- Schedule periodic GDPR compliance audits covering access controls, data processing activities, consent records, and data subject rights procedures.
- Assign a designated Data Protection Officer (DPO) or privacy lead to maintain a Records of Processing Activities (RoPA) register and monitor ongoing compliance obligations.