Poor management of employee access rights, which allowed one of them to unauthorizedly view the banking data of numerous clients, led the Romanian authority to sanction a banking institution for failing its security obligation.

Facts and context

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) published a sanction decision against ING BANK NV AMSTERDAM - BUCHAREST BRANCH, including the imposition of a fine of 26,735 lei (approximately €5,000), for breaches related to the security of personal data.

The case originated from a personal data breach notification submitted by the bank itself, concerning unauthorized access to its clients' data by one of its employees.

Grounds for the decision

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority found that the banking institution had not implemented appropriate technical and organizational measures to guarantee data confidentiality and prevent unauthorized access. Indeed, inadequate configuration and limitation of access rights allowed an employee to view, beyond their service duties, the banking data (client codes, account balances, monthly incomes, transaction information) of a significant number of clients. The authority thus concluded a breach of the obligation to ensure that employees acting under its authority process data only on its instructions, pursuant to paragraphs 1 points b) and d), 2 and 4 of Article 32 of the GDPR.

Authority's decision

Consequently, the authority imposed a fine of 26,735 lei (approximately €5,000) on ING BANK NV AMSTERDAM - BUCHAREST BRANCH.

Furthermore, the authority ordered the bank to take several corrective measures, including periodic verification of compliance with internal procedures related to granting and using access rights to client data. It also required the implementation of regular training for employees on their obligations, the risks associated with processing, and the necessity to access only the data strictly necessary for their functions to ensure confidentiality.

Lessons learned

This decision reminds that:

• Access rights and authorization management is a fundamental security measure that must be configured to technically limit employee access to only the data necessary for fulfilling their tasks.
• Security control is not a one-time exercise; it is the responsibility of the controller to periodically verify the adequacy and compliance of internal procedures, especially those governing access rights.
• Regular training of employees on their data protection obligations and the risks related to unauthorized access is an essential organizational measure to guarantee data confidentiality.