- Enforcing jurisdiction
- Romania · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
S.C. Marsorom S.R.L. – €3,000 Fine (Romania, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
S.C. Marsorom S.R.L. was fined for failing to protect customer data on its website, which was visible without authorization. The company did not follow rules about how long to keep personal data. This case highlights the need for businesses to secure customer information properly.
What happened
S.C. Marsorom S.R.L. allowed some personal data of its customers to be accessed without authorization on its website.
Who was affected
Customers of S.C. Marsorom S.R.L. whose personal data was exposed online without proper security measures.
What the authority found
The Romanian data protection authority found that the company failed to take adequate measures to protect personal data and violated GDPR storage rules.
Why this matters
This case serves as a warning for businesses to implement strong security measures for customer data and to adhere to data retention policies. Companies should regularly assess their data protection practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 15 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA conducted the investigation after being notified that on the website in question, some personal data of the website's customers were visible. If customers placed an order on the website, some of their personal data could be accessed without authorisation. Did the website operator, in its role as data controller, take sufficient technical and organisational measures to protect the personal data of its customers? Furthermore, did the controller act in breach of the storage limitation principle? The ANSPDCP held that the controller failed to take appropriate measures and breached the storage limitation principle enshrined in Article 5(1)(e) GDPR, and also failed to fulfill its obligation under Articles 25 and 32 GDPR. Consequently, the DPA issued a €3000 fine and recommended the website operator to establish a shorter storage period for the personal data associated with the accounts of its customers.
Related Enforcement Actions (1)
Other enforcement actions involving S.C. Marsorom S.R.L. in RO
Details
Fine Date
21 September 2020
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Fine Amount
€3,000
GDPRhub ID
gdprhub-2806About this data
Cite as: Cookie Fines. S.C. Marsorom S.R.L. - Romania (2020). Retrieved from cookiefines.eu
Last updated: