Renault Romania: Amend after the personal data of customers have been published online

Renault Romania was fined 125,000 euros by the National Authority for the Supervision of Personal Data Processing (ANSPDCP) following a cyber attack that led to the unauthorized disclosure of personal data of a large number of clients.

The investigation was initiated after the company notified the authority about the data security breach, in accordance with Regulation (EU) 2016/679. The compromised data includes names, surnames, phone numbers, addresses, personal codes, and information about employers. ANSPDCP found that Renault had not implemented adequate security measures, which led to this sanction.

GDPR expert, Tudor Galoș, emphasized that although the attack was caused by an authorized person, Renault, as the operator, is responsible for the legal consequences.