Kredyt Inkaso Investments RO S.A – €5,000 Fine (Romania, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Romanian company, Kredyt Inkaso Investments RO S.A, was fined EUR 5,000 for sharing personal data without permission. They also failed to report a data breach on time. This case highlights the importance of handling personal data responsibly and notifying authorities promptly when breaches occur.
What happened
Kredyt Inkaso Investments RO S.A disclosed personal data to medical institutions without authorization.
Who was affected
Individuals whose personal data, including home address and professional status, were shared without consent.
What the authority found
The Romanian DPA found that Kredyt Inkaso Investments RO S.A violated GDPR by sharing data without a valid legal basis and failing to report a data breach promptly.
Why this matters
This case underscores the need for companies to ensure they have a valid reason for processing personal data and to report breaches quickly. It serves as a reminder to businesses to review their data handling and breach notification procedures.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Romanian DPA has fined Kredyt Inkaso Investments RO S.A. EUR 5,000. A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract. In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Kredyt Inkaso Investments RO S.A in RO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
18 May 2022
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Fine Amount
€5,000
About this data
Cite as: Cookie Fines. Kredyt Inkaso Investments RO S.A - Romania (2022). Retrieved from cookiefines.eu
Last updated: