GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

TELEKOM ROMÂNIA MOBILE COMMUNICATIONS S.A.

Country
Romania
Fine
10,000 EUR
Date
30.03.21(30.03.21)
Sector
Private Sector
Articles
Article 32 (1) and (2)

Lack of appropriate organisational and technical measures

Failure of the controller to implement proper technical and organisational measures in order to ensure level of security appropriate to the risk of data processing has led to unauthorized disclosure of personal data (e.g. customer ID, customer code, name and surname, personal identification number, date of birth, gender, phone number, e-mail address, domicile/residence address, the value of the debts associated with the customer code) of 99,210 data subjects – customers of the controller. Moreover, this failure of the controller has led to unauthorized access to personal data in MyAccount accounts (i.e. the name of the account holder, date of birth, used telephone numbers, home address, email address, subscriber code, contracted services, active extra options on the account, invoice history) of 413 data subjects - customers of the controller.