Poland

Unknown

358,000 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2024-11-20.

Rank · Sector

of 218 in Not assigned

Rank · Poland

of 111

Rank · All fines

#282

of 3,050

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2024-11-20
Controller / Processor: Unknown
Sector: Not assigned
Quoted Articles: Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 358,000 on a company. The company had inadvertently published customer data (first name, last name, email address, home address, encrypted passwords) in the process of redesigning its website. The incident affected approximately 20,000 data subjects. The DPA found that the controller had not sufficiently ensured the security of personal data during the process, for example, by conducting regular tests and risk assessments. Instead, it relied on information provided by the hired subcontractor without proper oversight.

Open original source Links to the regulator's original publication or another source.