[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzy09uzF-uBdSnxRZhwSNTgp5k7Gr-kwJbNrVUC6UaHE":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"4f4bb566-ae4a-48df-9196-070f1b4d42a0","ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026","anspdcp-romania-fine-against-orange-romania-sa-of-july-17-2026-80bbd7","Small amendments to short summary ← Older revision Revision as of 08:28, 22 July 2026 Line 69: Line 69: }} }} A telecom company received a €100,000 fine for breaching Articles 25 and 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. The DPA fined €100,000 a telecom company for breaching Article 25 GDPR and Article 32 GDPR by failing to implement adequate technical and organizational safeguards and ensure the security of personal data processing. == English Summary == == English Summary == Line 79: Line 79: === Holding === === Holding === The investigation was initiated after the controller notified the DPA of a personal data breach pursuant to [[Article 33 GDPR|Article 33 GDPR]]. The investigation was initiated after the controller notified the DPA of a personal data breach pursuant to [[Article 33 GDPR]]. First, the DPA found that the controller infringed [[Article 25 GDPR|Article 25 GDPR]] by failing to implement appropriate technical and organisational measures when designing and operating its digital platforms. The DPA considered that these shortcomings enabled unauthorised access to personal data and failed to adequately protect data subjects' rights. For this infringement, the DPA imposed a fine of €20,000. First, the DPA found that the controller infringed [[Article 25 GDPR]] by failing to implement appropriate technical and organisational measures when designing and operating its digital platforms. The DPA considered that these shortcomings enabled unauthorised access to personal data and failed to adequately protect data subjects' rights. For this infringement, the DPA imposed a fine of €20,000. Second, the DPA found that the controller infringed [[Article 32 GDPR|Article 32 GDPR]] by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The DPA noted that the controller had not adequately secured its platforms and had failed to regularly test and assess the effectiveness of its security measures. For this infringement, the DPA imposed a fine of €80,000. Second, the DPA found that the controller infringed [[Article 32 GDPR]] by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The DPA noted that the controller had not adequately secured its platforms and had failed to regularly test and assess the effectiveness of its security measures. For this infringement, the DPA imposed a fine of €80,000. In addition, as a corrective measure, the DPA ordered the controller to implement a monitoring and testing process for all IT applications used in its activities. The process must include controls over software changes and vulnerability testing. In addition, as a corrective measure, the DPA ordered the controller to implement a monitoring and testing process for all IT applications used in its activities. The process must include controls over software changes and vulnerability testing. == Comment == == Comment == The decision illustrates the Romanian DPA's focus on enforcing the requirements of [[Article 25 GDPR|Article 25 GDPR]] and [[Article 32 GDPR|Article 32 GDPR]]. The DPA fined Orange Romania €100,000 for failures that led to unauthorised disclosures of personal data and a large-scale data breach, and ordered the company to strengthen its application monitoring and vulnerability-testing processes. The case follows a previous enforcement action against Orange Romania, which resulted in a €40,000 fine in 2025 for infringements relating to data subjects' rights and the unlawful retention of personal data. The decision illustrates the Romanian DPA's focus on enforcing the requirements of [[Article 25 GDPR]] and [[Article 32 GDPR]]. The DPA fined Orange Romania €100,000 for failures that led to unauthorised disclosures of personal data and a large-scale data breach, and ordered the company to strengthen its application monitoring and vulnerability-testing processes. The case follows a previous enforcement action against Orange Romania, which resulted in a €40,000 fine in 2025 for infringements relating to data subjects' rights and the unlawful retention of personal data. == Further Resources == == Further Resources ==","The Romanian Data Protection Authority (ANSPDCP) has fined Orange Romania SA €100,000 for breaching GDPR Articles 25 and 32. The company failed to implement adequate technical and organizational safeguards, leading to unauthorized access to personal data and a data breach. In addition to the fine, Orange Romania was ordered to implement enhanced monitoring and vulnerability testing for its IT applications.","Orange Romania fined €100,000 for GDPR violations related to data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_Orange_Romania_SA_of_July_17,_2026&diff=52440&oldid=52429","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fc\u002Fc2\u002FLogoRO.jpg","2026-07-22T08:28:49+00:00","2026-07-22T10:00:21.282064+00:00",7,[17,20],{"name":18,"type":19},"Orange Romania SA","vendor",{"name":21,"type":22},"digital platforms","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":25,"name":47,"slug":48},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":52,"vendors":139},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,94,102],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":83,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":111,"name":112,"problem":113,"products":114},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"orange-romania-fined-100k-for-gdpr-failures-in-data-protection-and-security-controls","Orange Romania Fined €100K for GDPR Failures in Data Protection and Security Controls","Orange Romania SA was fined €100,000 by the Romanian Data Protection Authority for failing to implement adequate technical and organizational measures as required by GDPR Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing). The breach resulted in unauthorized access to personal data, demonstrating that insufficient security controls in large telecommunications environments can directly expose customer information. This case underscores that GDPR compliance is not a checkbox exercise — regulators expect ongoing, demonstrable investment in security safeguards. The remediation order requiring enhanced monitoring and vulnerability testing signals that reactive security postures are no longer acceptable under European data protection law.",[145,146,147,148,149,150,151,152,153,154],"GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","NIST SP 800-53 RA-5 (Vulnerability Monitoring and Scanning)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-3 (Access Enforcement)","CIS Control 7 – Continuous Vulnerability Management","CIS Control 3 – Data Protection","CIS Control 16 – Application Software Security","ISO\u002FIEC 27001:2022 Annex A 8.8 – Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 Annex A 8.25 – Secure Development Life Cycle",{}]