AMATO BESTSELLER S.R.L — Regulatory Disclosure
- Victim: AMATO BESTSELLER S.R.L
- Date reported: 2026-08-06
- Country: RO
- Severity: Medium
Romania's data protection authority ANSPDCP sanctioned AMATO BESTSELLER S.R.L. after an investigation concluded in June 2026 found that the operator breached Article 32(4) GDPR by failing to instruct staff and control access, which allowed employees and former employees to have unauthorised access to personal data (including health and other special-category data) belonging to a considerable number of data subjects. Fine: 78,465 lei (EUR 15,000) for the Article 32(4) breach, alongside separate fines of 52,310 lei, 104,620 lei and 50,000 lei for breaches of Article 14, Article 5(1)(c) read with Article 9 GDPR, and Article 12(1) of Law no. 506/2004.