Poland

Company

135,600 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2024-12-18.

Rank · Sector

#74

of 322 in Finance, Insurance and Consulting

Rank · Poland

#18

of 111

Rank · All fines

#421

of 3,050

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2024-12-18
Controller / Processor: Company
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 38 (3) GDPR, Art. 30 (1) GDPR, Art. 35 (1), (7) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA fined a company in the banking sector EUR 135,600. The DPA inspected the fined company and found several violations of the GDPR. First, the company failed to ensure that the DPO could report directly to top management and that the DPO did not receive instructions on the performance of the tasks given to the DPO. Second, the company failed to include profiling in the list of data processing operations. Third, the company failed to conduct a privacy impact assessment regarding the use of profiling. The violation regarding the DPO resulted in a fine of EUR 61,600. The violation regarding the unlawful use of profiling resulted in a fine of EUR 74,000.

Open original source Links to the regulator's original publication or another source.