"750.000 people, but who notified them that their data was stolen?" Alexandru Tănase demands explanations after the cyberattack and invokes AGE's legal obligation to inform affected individuals

Former President of the Constitutional Court, Alexandru Tănase, is asking the authorities to explain why the individuals targeted by the recent cyberattack were not individually informed about the compromise of their data. In a Facebook post, he points out that the incident announced by the Electronic Governance Agency targeted approximately 750.000 IDNPs and information that may include family, health, financial situation, property or bank accounts. Tănase invokes the provisions of the Law on the Protection of Personal Data and argues that, when a breach may generate a high risk for citizens, a public statement cannot automatically substitute for informing the affected individuals.

Tănase draws attention primarily to the volume and nature of the information that, according to the data he presented, would have been compromised.

"The Electronic Government Agency announced yesterday that, following a cyber attack, data sets related to approximately 750.000 IDNPs were extracted without authorization. The figure is alarming, but even more worrying is the nature of the compromised information. We are not only talking about names, surnames or dates of birth, but also about family members, family doctor, social benefits, pensions, disabilities, properties, owned companies, bank accounts, tax debts and MPay payment history. Information that, put together, allows the reconstruction of a considerable part of a person's private life. Such a database can be used not only for financial fraud, but also for identity theft, blackmail, identification of personal and family vulnerabilities or influence operations. It may also be of interest to foreign intelligence services. AGE informs us that it has ordered the verification of 82 digital services, temporarily suspended the systems at risk and managed to isolate the attack. Very good", Tănase wrote on his Facebook page.

The former president of the Constitutional Court, however, raises the issue of individual information of persons whose data may have been compromised and expressly invokes the legal provisions.

"But what about the approximately 750.000 people whose data was compromised? Why, until now, have the authorities not announced that at least one of them had been individually informed about the theft of their data? Well, here we are not talking about technical subtleties, but about an express legal obligation. Article 34 paragraph (1) of Law no. 195/2024 on the protection of personal data provides: Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the operator shall inform the data subject without undue delay of the breach. Paragraph (2) provides that the information must be provided in clear and plain language and contain the necessary information regarding the incident and the protective measures", he explained.

Tănase claims that the reaction of institutions after such an incident is essential for citizens' trust in the state's digital services.

"A press release cannot automatically substitute for individual information of the affected persons. When information about the health, financial situation and family life of such a large number of people is compromised, the risks to privacy cannot be treated as a simple administrative detail. Every citizen must be able to find out if their data has been compromised, what information was extracted and how they can protect themselves. AGE has a legal obligation to inform the affected persons, under the conditions provided by law. And this information must be done without undue delay, not after the citizens' personal data ends up being sold on 999.md. Trust in the digital state is not built by laudatory statements about the performance of their own IT systems, but also by the way in which institutions assume responsibility when these systems fail", concluded Alexandru Tănase.