The National Supervisory Authority finalised, in April 2021, an investigation at World Class România S.A., finding the breach of the provisions of Article 32 of the General Data Protection Regulation.

Therefore, the controller World Class România S.A. was sanctioned with a fine in amount of Lei 9,851 (the equivalent of Eur 2000).

Within the investigation started following the receipt of an intimation, the National Supervisory Authority found that the controller World Class România S.A. has posted on the WhatsApp group of its employees a resignation request of one of his employees, thus permitting the unauthorised access of all the members of that WhatsApp group to certain personal data of the employee (first name, last name, address, series and number of the identity card, personal identification number, information regarding the request for termination of the employment relationship).

In this context, the National Supervisory Authority considered that the controller World Class România S.A. did not take sufficient technical and organisational measures in order to ensure the confidentiality of the personal data of the data subject.

Also, a corrective measure was applied to the controller World Class România S.A.. Therefore, within 30 days from the communication of the minutes, it was ordered to the controller to ensure the compliance of the processing operations with the General Data Protection Regulation, by implementing some appropriate technical and organisational measures in case of remote transmission of the personal data, inclusively by regularly training the employees.

Legal and Communication Department

ANSPDCP