Vodafone România S.A.

The controller erroneously sent the invoices of some customers to the e-mail addresses of third parties. This led to the unauthorized access to certain personal data of the controller’s customers, such as: name, surname, telephone number, customer code, address. The supervisory authority concluded that the failure of the controller to implement adequate security measures in order to ensure the confidentiality of personal data has led to the unauthorised disclosure of personal data of controller's customers.