Banca Transilvania was fined EUR 100,000 by the Romanian DPA (ANSPDCP) for violating Art. 5 (1) f) GDPR, Art 32 (1) GDPR, and Art. 32 (2) GDPR. The DPA found out that the bank asked a customer to declare the intended purpose and use of a specific amount of money withdrawn from their personal account. The statement was submitted to the bank online, and it was forwarded to a couple of employees of the bank. One of the employees took a picture of the declaration and forwarded it via WhatsApp. Then, the document was also posted on Facebook and another website. Therefore, this resulted in the unauthorized disclosure and access of personal data concerning four data subjects, despite the bank’s commitment to observe the principles of integrity and confidentiality of personal data, under Art. 5 (1) f) GDPR. The Data Protection Authority also noticed that this data breach showcased how under-trained the Bank’s employees were with regard to the standards for data protection. The DPA obliged the Bank to implement stricter and more rigorous technical and organizational measures, as well as trainings for its employees, under Art. 32 GDPR.
banca transilvania was   by the romanian dpa anspdcp for violating   f    and    the dpa found out that the bank asked a customer to declare the intended purpose and use of a specific amount of money withdrawn from their personal account the statement was submitted to the bank online and it was forwarded to a couple of employees of the bank one of the employees took a picture of the declaration and forwarded it via whatsapp then the document was also posted on facebook and another website therefore this resulted in the unauthorized disclosure and access of personal data concerning four data subjects despite the bank’s commitment to observe the principles of integrity and confidentiality of personal data under   f  the data protection authority also noticed that this data breach showcased how undertrained the bank’s employees were with regard to the standards for data protection the dpa obliged the bank to implement stricter and more rigorous technical and organizational measures as well as trainings for its employees under   
banca transilvania      romanian dpa anspdcp  violate   f         dpa find    bank ask  customer  declare  intend purpose  use   specific amount  money withdraw   personal account  statement  submit   bank online    forward   couple  employees   bank one   employees take  picture   declaration  forward  via whatsapp   document  also post  facebook  another website therefore  result   unauthorized disclosure  access  personal data concern four data subject despite  bank’ commitment  observe  principles  integrity  confidentiality  personal data    f   data protection authority also notice   data breach showcased  undertrained  bank’ employees   regard   standards  data protection  dpa oblige  bank  implement stricter   rigorous technical  organizational measure  well  train   employees    