In February 2024, the National the National Supervisory Authority for Personal Data Processing closed an investigation on the EURO MINI STORAGE ROMANIA SRL data controller, and found the violation of Article 32 (1) (b) and (d), in conjunction with Article 32 (2) and Article 24 (1) of the General Data Protection Regulation (GDPR).

Therefore, the data controller was sanctioned with a fine in the amount of 24,884.50 RON, the equivalent of 5,000 EUR.

The investigation was launched following a notification from the data controller on a personal data breach, submitted according to the GDPR.

The data breach resulted following a cyberattack which the controller was confronted with, including an incident of breach of the availability and confidentiality of personal data at the level of the server used in its IT infrastructure, the activity of EURO MINI STORAGE ROMANIA SRL having been suspended for several weeks.

During the investigation it was found that the data controller had not implemented the appropriate technical and organisational measures to ensure a level of security suitable to the risk of processing, in particular from the destruction, loss, alteration, unauthorised disclosure or unauthorised access to personal data.

This has led to breaches of confidentiality through unauthorised access to the IT infrastructure used by EURO MINI STORAGE ROMANIA SRL to certain personal data of a significant number of clients, as well as affecting the availability of these data for a period of several weeks.

At the same time, according to Article 58 (2) (d) of the GDPR, EURO MINI STORAGE ROMANIA SRL was also imposed the corrective measure to implement monitoring systems/logs for accessing the IT infrastructure used for the processing of personal data which include a retention period for access logs of at least 30 days, including the introduction of a back-up process.

Legal and Communication Department

A.N.S.P.D.C.P.