VODAFONE România S.A. – €2,915 Fine (Romania, 2021)

Breach notifications concerned misdirected service contracts and unauthorised staff access affecting six people between November 2020 and May 2021, and separate communications-security incidents involving unauthorised staff access to 64 people’s data between November 2020 and June 2021. ANSPDCP imposed RON 7,421.25, stated as EUR 1,500, for GDPR security failings, plus RON 7,000 under Article 3(1) and (3)(a) and (b) of Law 506/2004. The complete native fine is RON 14,421.25; the native overview rounds to whole lei. The sanction list cites GDPR Article 32(1)(b) and (2). The original is internally inconsistent in its paragraph references: its introduction cites Article 32(1)(b) and (4), while its monetary-sanction list cites Article 32(1)(b) and (2). All source-cited provisions remain visible with this limitation; the announcement alone does not resolve which paragraph reference was intended. The two incident counts are not asserted to be unique non-overlapping people. The separate national-law component concerns communications security, not cookie consent. The 7000 RON additional national-law component is converted at the ECB publication-date reference rate on 2021-11-11 of RON 4.9474 per EUR 1, rounded to EUR 1415. The expressly stated EUR 1500 GDPR component is preserved, giving approximately EUR 2915 in total. The conversion date is not the decision date. The official announcement reports investigation completion in 2021-10, without an exact decision day. Its later publication date is retained as a publication fact rather than the action date. Appeal status is not established by the announcement.