- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
ID Finance Poland Sp. z o.o. – €235,300 Fine (Poland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
ID Finance Poland made a mistake that exposed the personal data of over 140,000 customers. This happened when they restarted a server, which reset security settings and allowed a third party to access sensitive information. The fine of EUR 235,300 highlights the importance of having strong security measures in place to protect customer data.
What happened
ID Finance Poland exposed the personal data of 140,699 customers due to a server restart error that reset security settings.
Who was affected
Customers whose personal data, including names and addresses, was made publicly available.
What the authority found
The Polish data protection authority found that ID Finance Poland did not take sufficient measures to protect personal data, violating GDPR requirements.
Why this matters
This case emphasizes the need for companies to implement robust security measures to protect personal data. It serves as a warning that mistakes can lead to significant financial penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: national law identified, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Polish DPA (UODO) imposed a fine of EUR 235,300 on ID Finance Poland Sp. z o.o. Due to an error while restarting a server, the settings of the software responsible for the server's security were reset, making the personal data of 140 699 customers publicly available. These data contained, for example, information about the first and last name, address, nationality or even marital status of the data subjects. The database located on this server was downloaded and deleted by an unspecified third party, who demanded a fee from the company for the return of the database. The DPA noted that the controller had taken insufficient technical and organizational measures to ensure the protection of the processing, even though there was a high risk for the data subjects due to the nature of the data processed.
Related Enforcement Actions (0)
No other enforcement actions found for ID Finance Poland Sp. z o.o. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 December 2020
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€235,300
About this data
Cite as: Cookie Fines. ID Finance Poland Sp. z o.o. - Poland (2020). Retrieved from cookiefines.eu
Last updated: