- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
TUiR Warta S.A. – €18,850 Fine (Poland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
TUiR Warta S.A. was fined for not reporting a data breach involving customer information. An insurance agent mistakenly sent personal data to the wrong people and the company failed to notify the authorities on time. This case stresses the importance of timely reporting of data breaches.
What happened
TUiR Warta S.A. failed to notify the Polish DPA about a data breach involving customer data.
Who was affected
Customers of TUiR Warta S.A. whose personal data was leaked were affected.
What the authority found
The Polish DPA found that the company did not meet its obligation to report the data breach within the required time frame.
Why this matters
This ruling serves as a reminder that companies must act quickly to report data breaches. Delays can result in significant fines and loss of trust.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 13 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An insurance agent hired by the controller had sent an email to unauthorized third parties in regard to insurance policies that contained personal data of two of the company's customers after they had mistakenly provided false email addresses. The leaked data included data such as the names, email adresses and postal addresses of the data subjects. The controller had not informed either the Polish DPA nor the data subjects about the data breach in a timely manner within 72 hours. The controller believed that there was no breach requiring notification because the data subjects themselves had mistakenly provided incorrect e-mail addresses. The Polish DPA states that this circumstance does not release the controller from its obligation to report this data breach in a timely manner.
Related Enforcement Actions (0)
No other enforcement actions found for TUiR Warta S.A. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
9 December 2020
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€18,850
About this data
Cite as: Cookie Fines. TUiR Warta S.A. - Poland (2020). Retrieved from cookiefines.eu
Last updated: