# ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026

- Type: News
- Source: GDPRhub
- Date: 2026-07-21
- Original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Orange_Romania_SA_of_July_17,_2026
- Canonical: https://overview.legal/posts/144034
- Topics: Telecommunications, Security, Access Controls, Identification, Inspection Access Rights and Cooperation Obligations, Personal Data, Controllers

## Summary

A telecom company received a €100,000 fine for breaching Articles 25 and 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. English Summary. Facts. A customer (the data subject) of Orange Romania SA (the controller) was able to access and download invoices belonging to other customers. As a result, personal data such as names, addresses, delivery addresses, ID document details, and invoice information were disclos

## Full text

A telecom company received a €100,000 fine for breaching Articles 25 and 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. English Summary. Facts. A customer (the data subject) of Orange Romania SA (the controller) was able to access and download invoices belonging to other customers. As a result, personal data such as names, addresses, delivery addresses, ID document details, and invoice information were disclosed. The incident was caused by a mismatch between two interconnected applications, which incorrectly linked the data subject's account to an employee account. During the investigation, another vulnerability was identified in the controller's ticketing application. The platform was publicly accessible and lacked adequate security measures, such as VPN protection, multi-factor authentication, and IP-based access restrictions. This vulnerability enabled a cyberattack that resulted in the

---
Generated by overview.legal · https://overview.legal/posts/144034 · 2026-07-23