Poland
Centrum Medyczne Ujastek Sp. z o.o.
GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2024-01-17.
Case details
- Authority
- Polish National Personal Data Protection Office (UODO)
- Date
- 2024-01-17
- Controller / Processor
- Centrum Medyczne Ujastek Sp. z o.o.
- Sector
- Health Care
- Quoted Articles
- Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR
- Type of violation
- Non-compliance with general data processing principles
Summary
The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed for the unlawful installation of surveillance equipment in two neonatal rooms. These devices recorded images of newborns and their mothers during intimate acts such as breastfeeding or care without informing patients or staff, which constitutes a violation of data protection regulations.
The second fine, of around EUR 110,000, was imposed due to the loss or theft of memory cards on which these recordings were stored. The cards were not encrypted and the devices were not configured in accordance with the required security standards. It was also found that the risk analysis of the center did not take into account the dangers that led to this incident.
---UPDATE---
Following an appeal by the controller, the Provincial Administrative Court in Warsaw upheld the imposed fine.
Related fines