The Romanian data protection authority (ANSPDCP) sanctioned a company for failing to implement adequate security measures, which led to a data breach following a cyberattack. The decision highlights the importance of regularly testing the effectiveness of technical and organizational measures and ensuring the confidentiality of processing systems.

Facts and context

The Romanian data protection authority (ANSPDCP) today published a sanction decision against GLOBAL CUSTOMER CARE SERVICES S.R.L., including the imposition of a fine of €5,000 (26,294 lei), for failures related to the security of personal data processing.

The case began with the notification of a data breach by the company itself, following a cyberattack that affected the confidentiality and availability of its systems.

Grounds for the decision

• Obligation to ensure the security of processing (Article 32 of the GDPR): The investigation, initiated following the notification of the breach, revealed that a cyberattack allowed unauthorized access to the personal data of a significant number of individuals, including employees and former employees. The compromised data included identification, contact, salary, banking, and professional information. The authority found that the data controller had not implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The company was specifically reproached for failing to ensure the ability to guarantee the confidentiality of processing systems and for lacking a process to regularly test, analyze, and evaluate the effectiveness of its security measures.

Authority's decision

Consequently, the authority imposed a fine of €5,000 (26,294 lei) on GLOBAL CUSTOMER CARE SERVICES S.R.L.

Furthermore, the authority ordered the company to implement monitoring and logging systems for access to its IT infrastructure. These measures must include a retention period for activity logs of at least 30 days as well as a backup process for these logs.

Lessons learned

This decision reminds that:

• Data security is not limited to implementing measures but requires establishing an active and regular process to test, analyze, and evaluate their effectiveness, in accordance with Article 32(1)(d) of the GDPR.
• The implementation of monitoring and logging systems for access, with an appropriate retention and backup policy, constitutes a fundamental technical measure to ensure security and enable incident analysis.
• The notification of a data breach triggers an investigation by the supervisory authority that will focus not only on the management of the incident itself but also on the adequacy of the pre-existing security measures that failed.