Banca Comercială Română S.A.

The sanction imposed by the supervisory authority was triggered by the failure of the controller to observe the transparency and accuracy principles while processing personal data of its client-data subject, such processing being carried out without legal basis under GDPR. The supervisory authority found during its investigation that the controller unlawfully processed the personal data of the data subject – controller’s client, by erroneously assigning to the respective data subject the quality of guarantor, processing outdated data, and disclosing personal data in notification procedures carried out through a bailiff, that concerned the arrears of a credit agreement of a legal entity – client of the controller, with which the data subject concerned had no relationship.