Vodafone România SA – €3,000 Fine (Romania, 2020)

The ANSPDCP carried out investigation against the Romanian telecommunication operator Vodafone România SA. The company transmitted personal data to inaccurate e-mail address while handling a data subject's complaint. Did the controller processed personal data in line with the GDPR principles? The ANSPDCP found that the company processed personal data without having implemented sufficient security measures. Thus it violated the principles of accuracy, integrity and confidentiality as laid down in Article 5(1)(d) and (f) GDPR read in conjunction with the principle of accountability according to Article 5(2) GDPR. The ANSPDCP imposed a fine of 14308.8 lei (equivalent to EUR. 3.000) and pursuant to Article 58(2)(d) GDPR it ordered the complany to put in place efficient technical and organisational measures within 30 days.