Vodafone România SA – €2,000 Fine (Romania, date unknown)

€2,000Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter PersonalDate not establishedRomania
unknown
Fine

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

In two notified incidents, inadequate checks that processors followed caller-identification procedures allowed third parties to fraudulently buy phones in customers’ names and access contract and My Vodafone account details, including identifiers, contact details, PUK and SIM information, unpaid-bill amounts and data traffic. ANSPDCP imposed RON 9,890.80, stated as EUR 2,000, for security and instruction-related failings. The introduction cites Articles 29 and 32(1)(b), (2) and (4); the final fine explanation expressly repeats Articles 29 and 32(1)(b) and (2). The native overview rounds to whole lei; the exact source amount remains here. The complete announcement establishes no operative decision date. Its dated publication heading and URL are not substituted for an adopted date or period.

What happened

In two notified incidents, inadequate checks that processors followed caller-identification procedures allowed third parties to fraudulently buy phones in customers’ names and access contract and My Vodafone account details, including identifiers, contact details, PUK and SIM information, unpaid-bill amounts and data traffic.

Who was affected

The original announcement identifies Vodafone România SA as the sanctioned Romanian controller.

What the authority found

ANSPDCP imposed RON 9,890.80, stated as EUR 2,000, for security and instruction-related failings. The introduction cites Articles 29 and 32(1)(b), (2) and (4); the final fine explanation expressly repeats Articles 29 and 32(1)(b) and (2). The native overview rounds to whole lei; the exact source amount remains here.

Why this matters

All source-cited provisions remain visible with their context. The authority does not establish an operative decision day or month; 19 September 2022 is its publication heading and is not substituted for the action date. No additional national electronic-communications fine is announced.

GDPR Articles Cited
Automatically processed
Art. 29 GDPR
Art. 32(1)(b) GDPR
Art. 32(2) GDPR
Art. 32(4) GDPR
View original scraped data
Article 29 GDPR
Article 32(1)(b) GDPR
Article 32(2) GDPR
Article 32(4) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Source checks

Linked-source text retrieved.

Automated check recorded — 18 October 2026.

No issues were reported by that automated check.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

In two notified incidents, inadequate checks that processors followed caller-identification procedures allowed third parties to fraudulently buy phones in customers’ names and access contract and My Vodafone account details, including identifiers, contact details, PUK and SIM information, unpaid-bill amounts and data traffic. ANSPDCP imposed RON 9,890.80, stated as EUR 2,000, for security and instruction-related failings. The introduction cites Articles 29 and 32(1)(b), (2) and (4); the final fine explanation expressly repeats Articles 29 and 32(1)(b) and (2). The native overview rounds to whole lei; the exact source amount remains here. All source-cited provisions remain visible with their context. The authority does not establish an operative decision day or month; 19 September 2022 is its publication heading and is not substituted for the action date. No additional national electronic-communications fine is announced. The complete announcement establishes no operative decision date. Its dated publication heading and URL are not substituted for an adopted date or period. Appeal status is not established by the announcement.

Details

Fine Date

Date not established

Authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal

Fine Amount

€2,000

9,891 RON

GDPRhub ID

gdprhub-5264

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. Vodafone România SA - Romania (date unknown). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: