[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f03DATEhUihPWR9LlkeGx5bk4j8J0NHQLr63BWfjxEhw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"4c5142e3-36d1-4120-a47e-49900e31ad5b","romanian-retailer-fined-54k-for-gdpr-failures-including-unauthorized-employee-data-access","92430de2-2e4c-4710-a913-599d4fc3976d","Romanian Retailer Fined €54K for GDPR Failures Including Unauthorized Employee Data Access","AMATO BESTSELLER S.R.L. failed to implement adequate technical and organizational security measures, allowing both current and former employees unauthorized access to sensitive personal data — a fundamental access control failure. Beyond the access breach, the company compounded its liability by processing data excessively beyond stated purposes, providing inaccurate information to data subjects, and sending marketing communications without valid consent. This case illustrates how multiple simultaneous GDPR violations significantly amplify regulatory penalties. It serves as a critical reminder that GDPR compliance is not a one-time checkbox but requires ongoing governance across access management, data minimization, transparency, and consent frameworks.","**Immediate Actions:**\n- Revoke all system and data access for departing employees on the same day of termination using a formal offboarding checklist.\n- Conduct an immediate audit of who currently has access to personal data stores and remove any accounts that are excessive, stale, or no longer justified.\n\n**Data Governance & Compliance:**\n- Implement a data minimization review to ensure only necessary personal data is collected and retained in line with GDPR Article 5(1)(c).\n- Establish a valid consent management platform (CMP) to capture, record, and honor marketing consent before sending any commercial communications.\n- Create and maintain accurate, up-to-date privacy notices so data subjects receive transparent information as required under GDPR Articles 13 and 14.\n\n**Long-Term Improvements:**\n- Adopt role-based access control (RBAC) with the principle of least privilege to restrict personal data access to only those with a demonstrated business need.\n- Schedule periodic GDPR compliance audits covering access controls, data processing activities, consent records, and data subject rights procedures.\n- Assign a designated Data Protection Officer (DPO) or privacy lead to maintain a Records of Processing Activities (RoPA) register and monitor ongoing compliance obligations.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 13 & 14 – Transparency \u002F Information to Data Subjects","GDPR Article 32 – Security of Processing","GDPR Article 6 – Lawfulness of Processing","ePrivacy Directive Article 13 – Unsolicited Communications","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST Privacy Framework PR.AC – Identity Management and Access Control","ISO\u002FIEC 27001:2022 Annex A 5.18 – Access Rights",{},"published","2026-08-14T14:20:23.297498+00:00","2026-08-14T14:20:23.214+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_AMATO_BESTSELLER_S.R.L.&diff=52696&oldid=0","anspdcp-romania-amato-bestseller-s-r-l-7b4099","ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":58,"name":59,"problem":60},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":62,"name":63,"problem":64},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]