Romania

After a cyberattack on its test server, a third party accessed email addresses, phone numbers, names, personal numeric codes and ID document data. The authority found inadequate security measures and use of real data instead of fictitious data for testing, and ordered an internal procedure limiting development and test environments to fictitious data. The investigation followed an Art. 33 breach notification; the fine was reported as the equivalent of EUR 6,000.

Following a complaint, the authority found the hospital had not properly resolved a request for a copy of a phone call and video footage. It ordered a complete reply, revised procedures for requests under Arts. 12 to 22 and regular staff training. The fine was reported as the equivalent of EUR 1,000.

After a cyberattack, employees' and former employees' data were accessed without authorisation. The authority found inadequate technical and organisational measures and ordered access monitoring with logs kept for at least 30 days, and a backup process. The investigation followed an Art. 33 breach notification; the fine was reported as about EUR 5,000. Date is the publication date; the investigation was completed in August 2026.

After a complaint, the authority found the company used fingerprint timekeeping and access control for employees without a legal basis when less intrusive options existed. It ordered the biometric system replaced. The fine was reported as EUR 5,000.

Fined for inadequate internal control mechanisms in handling claim files and setting up the reserve for reported claims. Published in the ASF Council's July 2026 monthly release; no provisions are cited.

Received a written warning for not resolving a compulsory motor third-party liability claim within the time in Art. 21(1) and not paying compensation within the deadlines in Art. 21(2) and (4). Published in the ASF Council's July 2026 monthly release.

Fined as shareholder of Prebet S.A. for not launching a public takeover bid for the issuer. Published in the ASF Council's July 2026 monthly release of 26 August 2026.

Fined for not publishing inside information in a way that lets investors assess it fully, and for not publishing new financial calendar dates within the legal deadline before a closed period began. Published in the ASF Council's July 2026 monthly release of 26 August 2026, which gives no decision number or provisions.

Between 14 February and 21 November 2024 he took eight client trading orders through personal email, against the internal policy requiring the company address, so the messages were not kept in the firm's records. The fault was negligent and no harm to third parties was found. The decision was challenged in court (case 2393/2/2026, per ASF's list).

A periodic inspection led to a consolidated fine of 49,875 lei for eleven findings: an inadequate whistleblowing procedure, personal transactions not recorded in the register, no effective measures to stop an insider trade in a closed period, missing durable-medium confirmations, a procedure that left out two remediation-plan obligations, and enhanced due diligence not applied to politically exposed persons. Other findings, including late OTC publication through an APA, drew warnings only. The remediation plan came from ASF Decision 184/21.02.2024. The decision was challenged in court (case 2994/2/2026, per ASF's list).