Pactum Poland Sp. z o.o. – €4,184 Fine (Poland, 2021)

The DPA received a complaint from a data subject, regarding irregularities in the processing of his personal data by Pactum Poland Sp. z o.o. (the controller), which is a loan company. The DPA asked the controller several times to respond to the content of the complaint and to answer questions regarding the case. The DPA wanted to know from the controller, among other things, whether the controller is currently processing the data subject's data and, if so, on what legal basis and for which purpose. Moreover, the DPA wanted to know whether the company has properly informed the data subject before collecting his data and whether the controller has disclosed the data subject's data to a third party and, if so, on what legal basis. Despite receiving the numerous requests of the DPA, the controller did not respond to any of them. As a result the DPA initiated ex officio proceedings against the controller for not complying with the requests of the DPA. The DPA fined Pactum Poland Sp. z o.o. PLN 18,192 (approx. €3862) for failing to cooperate with the DPA by not providing access to personal data and other information necessary for the performance of the DPA's tasks under Article 58(1)(e) GDPR. The DPA also found that, by not answering the questions of the DPA, the controller violated its general obligation to cooperate with the DPA under Article 31 GDPR. In the DPA's view, the controller's failure to respond, indicates the controller's unwillingness to support the DPA in establishing the facts of the case and correctly resolving it, and a flagrant disregard of its obligation to cooperate with the DPA. In view of the above, the DPA concluded that the requirements for imposing an administrative fine under Article 83(4)(a) and (5)(e) GDPR were met.