Poczta Polska SA (Polish Post)

Summary

The Polish DPA has imposed a fine of EUR 6.3 million on Poczta Polska SA (Polish Post) for the unlawful disclosure of personal data of over 30 million citizens from the PESEL database, in connection with the planned postal vote during the Covid-19 pandemic.

Although the law amending the electoral regulations had not yet come into effect, the Ministry of Digital Affairs transferred sensitive data such as names, addresses, and PESEL numbers to the postal company. The data was only deleted weeks later—too late, according to the DPA, and in violation of data protection regulations.

--Update--

The Provincial Administrative Court in Warsaw overturned the DPA's decision. The court argued that, even though the Prime Minister's decision on which the processing had been based was overturned at a later stage, the decision enjoyed the presumption of legality. Therefore, the controller could base its processing on this decision.