The National Supervisory Authority for Personal Data Processing completed, in January current year, an investigation at the controller Meedea Construct Prest SRL and found the breach of Article 5 paragraph (1) letters a) b) and f) and of paragraph (2) in conjunction with Articles 6 and 9 of Regulation (EU) 2016/679.

As such, the controller was sanctioned:

with fine of 9,949.5 lei (the equivalent of 2,000 euros).

The investigation was started as a result of a complaints submitted by a natural person who complained that the controller Meedea Construct Prest SRL (former employer) disclosed documents related to his employment (copy of the individual employment contract, skills sheet, a medical certificate) to another third party and that third party used them in a litigation in court.

During the investigation, it was found that the controller Meedea Construct Prest SRL disclosed personal and health data belonging to the petitioner (former employee), such as: name, first name, address, identity card number and series, personal identification number, position/job/occupation, signature, date of birth, home address, medical conditions, signature and doctor’s initials, without complying with the legal conditions.

In this context, the provisions of Article 5 paragraph (1) letters a), b) and f) and paragraph (2), Articles 6 and 9 of the GDPR regarding the principles and legality of personal data processing were infringed, thus the controller being fined.

At the same time, based on the provisions of Article 58 paragraph (2) letter b) of Regulation (EU) 2016/679, the controller was ordered the corrective measure to ensures the compliance of collection and further processing operations of personal data with the GDPR, so as to avoid accessing and disclosing personal data processed by infringing the principles and the conditions of legality; in this way, the application of appropriate security and confidentiality measures shall also be taken into account, by establishing written procedures and regular training of persons who process data under the controller’s authority.

Legal and Communication Department

A.N.S.P.D.C.P