The National Supervisory Authority finalized in October 2022 an investigation at Prestige Media PHG SRL and found the breach of the provisions of Article 5 paragraph (1) letter a) and paragraph (2) from the General Data Protection Regulation (GDPR).

In this context, Prestige Media PHG SRL was sanctioned with fine in amount of Lei 24,683.5 (the equivalent of EUR 5,000).

The investigation was started following an intimation regarding a possible breach of the GDPR provisions by publishing on the controller’s website of some confidential documents among which also decisions of termination of the individual employment agreements of some employees of another companies.

Within the investigation performed, it was found that, on that website, a number of 23 nominal decisions for the termination of the individual mandate/employment agreements containing personal data (first name, last name, position, number of the employment agreement, disciplinary offences) of several natural personal were disclosed, although they did not have any legal relationship with Prestige Media PHG SRL.

Also, it was found that the controller did not present proofs from which to result that it processed lawfully the personal data from the 23 documents in the context of the unauthorized disclosed in the online, by publishing them on its website, by reference to the provisions of Article 6 GDPR.

Therefore, the National Supervisory Authority found the breach by Prestige Media PHG SRL of the personal data processing principles provided under Article 5 paragraph (1) letter a) and paragraph (2) and of Article 6 from the GDPR.

Also, the corrective measure of erasure/anonymization of the information allowing the identification of the data subjects from the content of the decisions for the termination of the mandate/employment agreements published on its website was applied.

Legal and Communication Department

A.N.S.P.D.C.P.