News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026

Telecommunications Security Access Controls Identification Inspection Access Rights and Cooperation Obligations Personal Data Controllers
Jul 21, 2026 Source

How it connects

Related across sources

Guidance Coordinated Enforcement Action, implementation of the right of access by controllers EDPB Guidance EDPB Annual Report 2022 EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Guidance Guidelines 02/2021 on virtual voice assistants EDPB Guidance Guidelines 8/2020 on the targeting of social media users EDPB Guidance Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications EDPB

Full text

A telecom company received a €100,000 fine for breaching Articles 25 and 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. English Summary. Facts. A customer (the data subject) of Orange Romania SA (the controller) was able to access and download invoices belonging to other customers. As a result, personal data such as names, addresses, delivery addresses, ID document details, and invoice information were disclosed. The incident was caused by a mismatch between two interconnected applications, which incorrectly linked the data subject's account to an employee account. During the investigation, another vulnerability was identified in the controller's ticketing application. The platform was publicly accessible and lacked adequate security measures, such as VPN protection, multi-factor authentication, and IP-based access restrictions. This vulnerability enabled a cyberattack that resulted in the

Original document at the source gdprhub.eu

Similar Content