The National Supervisory Authority for Personal Data Processing completed, in December 2024, an investigation at the controller S.P.E.E.H. HIDROELECTRICA S.A. and found the breach of Article 25 paragraphs (1) and (2) of Regulation (EU) 2016/679.

As such, the controller was fined in the amount of 74,562 lei (the equivalent of 15,000 euros).

The investigation was launched following the submission by the controller S.P.E.E.H. HIDROELECTRICA S.A. of a data breach notification, pursuant to the provisions of Article 33 of Regulation (EU) 2016/679.

During the investigation, it was found that the personal data breach occurred within and at the time of the launch of the controller’s application, as a result of a technical error and the failure to carry out sufficient testing of it in a test environment, which would simulate the environment of real use in all processes and interactions with other applications used by the controller.

This situation led to the loss of integrity and availability of personal data, respectively to unauthorised disclosure and/or access to personal data belonging to a significant number of data subjects.

Consequently, since the controller did not process personal data in a way that ensures their adequate security, including protection against unauthorised or illegal processing and against accidental loss, destruction or damage, by taking appropriate technical or organisational measures, it was sanctioned with a fine, for violating the provisions of Article 25 paragraphs (1) and (2) of Regulation (EU) 2016/679.

At the same time, the controller was ordered the corrective measure to implement technical and procedural of a testing plan in the test environment, which would simulate the real production scenario in all plausible situations in the production environment, prior to the production launch of all the components/applications that want to be introduced within the activities that include personal data processing.

The controller paid the established fine.

Legal and Communication Department

A.N.S.P.D.C.P