The National Supervisory Authority for Personal Data Processing completed, in November 2024, an investigation at the controller UNICREDIT CONSUMER FINANCING IFN S.A. and found the infringement of Article 6 paragraph (1) in conjunction with the provisions of Article 5 paragraph (1) letters a) and f), of paragraph (2) and of Article 32 paragraph (4) of Regulation (EU) 2016/679.

For the committed act, the controller was fined with 24,885 lei, the equivalent of 5,000 euros.

The investigation was started as a result of the transmission by the controller UNICREDIT CONSUMER FINANCING IFN S.A. of a personal data breach notification, based on its obligation according to the provisions of Article 33 of Regulation (EU) 2016/679.

It was reported that personal data such as: name, surname, function, signature belonging to certain data subjects (former employees) were processed by including them in certain contractual documents and used in the relationship with the controllers’ customers and collaborators, although their individual employment contracts were terminated.

During the investigation, it was found that controller UNICREDIT CONSUMER FINANCING IFN S.A. processed the personal data of some former employees, as a result of some operational errors, in violation of the principles provided by the Regulation.

At the same time, it was found that the controller did not responsibly monitor the application of the procedures which ensure the confidentiality and the security of the personal data, which led to the use of some versions of documents with non-updated signatories.

In this context, the processing of personal data was carried out without a legal basis, in violation of the processing principles related to legality, security and protection against unauthorised or illegal processing.

For this deed, the controller was fined for infringing the provisions of Article 6 paragraph (1) of Regulation (EU) 2016/679 in conjunction with the provisions of Article 5 paragraph (1) letters a) and f), or paragraph (2) and of Article 32 paragraph (4).

At the same time, the corrective measure of implementing a plan to monitor the application of the procedures so as to ensure the compliance with the provisions of the Regulation at all times, also in regards to the processing of personal data of employees who terminate the contractual employment relationship with UNICREDIT CONSUMER FINANCING IFN S.A., was ordered.

The controller has paid the established fine.

Legal and Communication Department

A.N.S.P.D.C.P