[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fK1oDwmb9Bx_dcRTxndmNjyYe1XZexJvhZxIK2pPZi94":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48},"647867eb-3a3b-4e4c-8379-6c35a2d13d1b","orange-romania-fined-100k-for-gdpr-failures-in-data-protection-and-security-controls","4f4bb566-ae4a-48df-9196-070f1b4d42a0","Orange Romania Fined €100K for GDPR Failures in Data Protection and Security Controls","Orange Romania SA was fined €100,000 by the Romanian Data Protection Authority for failing to implement adequate technical and organizational measures as required by GDPR Articles 25 (Data Protection by Design and by Default) and 32 (Security of Processing). The breach resulted in unauthorized access to personal data, demonstrating that insufficient security controls in large telecommunications environments can directly expose customer information. This case underscores that GDPR compliance is not a checkbox exercise — regulators expect ongoing, demonstrable investment in security safeguards. The remediation order requiring enhanced monitoring and vulnerability testing signals that reactive security postures are no longer acceptable under European data protection law.","**Immediate actions:**\n- Conduct a gap assessment against GDPR Articles 25 and 32 to identify missing technical and organizational safeguards across all IT systems processing personal data.\n- Perform an emergency vulnerability scan of all internet-facing and customer-data-handling applications to identify and remediate exploitable weaknesses.\n\n**Long-term improvements:**\n- Embed Data Protection by Design principles into the software development lifecycle so security controls are built in from the start, not bolted on afterward.\n- Establish a formal, recurring vulnerability management programme with defined SLAs for remediation based on risk severity.\n- Maintain a comprehensive data mapping inventory to ensure all personal data flows are known, protected, and subject to appropriate access controls.\n\n**Detection & monitoring measures:**\n- Deploy continuous security monitoring and anomaly detection on systems that store or process personal data to enable rapid identification of unauthorized access.\n- Schedule regular penetration testing and third-party security audits of IT applications at least annually or after significant system changes.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 32 – Security of Processing","NIST SP 800-53 RA-5 (Vulnerability Monitoring and Scanning)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-3 (Access Enforcement)","CIS Control 7 – Continuous Vulnerability Management","CIS Control 3 – Data Protection","CIS Control 16 – Application Software Security","ISO\u002FIEC 27001:2022 Annex A 8.8 – Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 Annex A 8.25 – Secure Development Life Cycle","published","2026-07-22T10:21:04.44767+00:00","2026-07-22T10:21:04.18+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=ANSPDCP_(Romania)_-_Fine_against_Orange_Romania_SA_of_July_17,_2026&diff=52440&oldid=52429","anspdcp-romania-fine-against-orange-romania-sa-of-july-17-2026-80bbd7","ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]