Vodafone România S.A. – €1,017 Fine (Romania, 2021)

Vodafone mistakenly emailed customer invoices to third parties, allowing unauthorised access to names, telephone numbers, customer codes and addresses. The company reported the incident under Article 33 GDPR. ANSPDCP imposed RON 5,000 for insufficient electronic-communications security safeguards under Article 3(1) and (3)(a) and (b) of Law 506/2004. The authority reiterated the need for internal staff training. The announcement does not impose a GDPR Article 33 fine or establish a cookie-consent infringement. The source explicitly says that the investigation was completed in May of the current year in its 27 May 2021 announcement, establishing May 2021 without an exact decision day. The Article 33 notification initiated the investigation and is not itself a finding of infringement. The 5000 RON fine is converted at the ECB publication-date reference rate on 2021-05-27 of RON 4.9161 per EUR 1, rounded to EUR 1017. The conversion date is not the decision date. The official announcement reports investigation completion in 2021-05, without an exact decision day. Its later publication date is retained as a publication fact rather than the action date. Appeal status is not established by the announcement.