- Enforcing jurisdiction
- Romania · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Kredyt Inkaso Investments RO S.A – €5,000 Fine (Romania, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Kredyt Inkaso Investments RO S.A. was fined €5,000 for sharing personal data of a customer and their child without permission. This case matters because it highlights the importance of protecting sensitive information and notifying authorities about data breaches. Companies must be careful with personal data to avoid legal issues.
What happened
Kredyt Inkaso Investments RO S.A. was fined for disclosing personal data to medical institutions without authorization.
Who was affected
A customer and their minor child were affected by the unauthorized data disclosure.
What the authority found
The Romanian DPA found that Kredyt Inkaso violated GDPR by failing to notify about the data breach in a timely manner.
Why this matters
This ruling emphasizes the need for businesses to handle personal data responsibly and to report breaches promptly. Companies should establish clear protocols for data protection and breach notification.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Romanian DPA has fined Kredyt Inkaso Investments RO S.A. EUR 5,000. A data subject had filed a complaint with the DPA against the controller for having disclosed their personal data and that of their minor child to medical institutions without authorization and without the data subject having any relationship with the institutions. During its investigation, the DPA found that the controller had disclosed data such as home address, professional status, as well as data from the employment contract. In addition, the DPA found that the controller had not notified the DPA of the data breach in a timely manner required by Art. 33 GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Kredyt Inkaso Investments RO S.A in RO
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
18 May 2022
Authority
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
Fine Amount
€5,000
GDPRhub ID
gdprhub-4966About this data
Cite as: Cookie Fines. Kredyt Inkaso Investments RO S.A - Romania (2022). Retrieved from cookiefines.eu
Last updated: