Poland

Unknown

4,700 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2024-11-20.

Rank · Sector

#102

of 218 in Not assigned

Rank · Poland

#75

of 111

Rank · All fines

#1,861

of 3,050

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2024-11-20
Controller / Processor: Unknown
Sector: Not assigned
Quoted Articles: Art. 28 (3) c), f) GDPR, Art. 32 (1) , (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 4,700 on a subcontractor that was contracted to redesign the website of another company. This fine is linked to ETid-2491. Due to an error by an employee of the subcontractor, customer data (including first name, last name, email address, address, and encrypted passwords) was accidentally published on the website during the redesign process. The incident affected approximately 20,000 data subjects. During its investigation, the DPA found that the subcontractor had failed to implement and verify appropriate technical and organizational measures to protect personal data, which could have prevented such an incident.

Open original source Links to the regulator's original publication or another source.