How could an employee of a school take 17 credits on behalf of others? A car -type Association, fined for not verifying the data

The National Supervisory Authority of Personal Data announced on Tuesday that it has fined 3,000 euros the Association of Mutual Aid House “Flexicredit” because it has granted 17 credits, based on documents transmitted by electronic means by a third person, without having the agreement of the data subjects on whose behalf the credit agreements were concluded. The association thus violated the EU Regulation on personal data protection (GDPR).

“The investigation was started as a result of a complaint transmitted by the Association of Mutual Aid House” Flexicredit “, reporting that an employee of a secondary school obtained unauthorized access to the official e-mail address of the educational unit and sent false documents to Flexicredit for contracting 17 credits.

During the investigation carried out, it was found that, between 2023-2024, the Association of Mutual Aid House “Flexicredit” granted 17 credits based on documents transmitted by electronic means by a third person, without having the agreement of the data subjects on whose behalf the credit agreements were concluded, “the authority statement said.

The institution also says that the association is guilty of not being properly verified the identity of the applicants in the case of remote credit applications, in relation to the documents received from them.

“At the same time, it was found that the Association of Mutual Aid House” Flexicredit “did not implement adequate technical and organizational measures in order to ensure a security level corresponding to the risk of processing, which led to the processing of personal data (eg name, first name, personal numeric code, home address, series/no. of persons data subject in the context of granting 17 credits based on forged documents ”, mentions the Data Protection Authority.

As such, in relation to the criteria for individualizing the sanctions provided by art. 83 of the RGPD, the sanction of the operator was established the Association of the Mutual Aid House “Flexicredit” with a fine for violating the provisions of art. 32 para. (2) from RGPD.

Photo source: Tatiana Sviridova / Dreamstime.com