- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Śląski Uniwersytet Medyczny (Medical University of Silesia) – €5,500 Fine (Poland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Medical University of Silesia was fined for not protecting student exam recordings properly. After online exams, recordings were accessible to unauthorized people, and the university failed to notify anyone about the data breach. This case emphasizes the need for better data security practices in educational institutions.
What happened
The Medical University of Silesia allowed unauthorized access to student exam recordings and did not report the data breach.
Who was affected
Students whose exam recordings were exposed to unauthorized individuals.
What the authority found
The Polish data protection authority found that the university violated GDPR by not securing exam recordings and failing to notify affected students about the breach.
Why this matters
This ruling highlights the importance of data security in educational settings. Universities must ensure that sensitive information is protected and that they promptly inform affected individuals about breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 14 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Polish DPA (UODO) imposed a fine of PLN 25,000 (EUR 5,500) on the Medical University of Silesia. In the course of exams held in the form of videoconferences at the end of May 2020, identification of students took place. Once the exam was completed, the recordings of the exams were available not only to the examinees, but also to other people with access to the system. In addition, any outsider could access the records of the examinations and the data of the examined students presented during identification via a direct link. The University failed to report the data breach to the DPA and notify the data subjects.
Related Enforcement Actions (0)
No other enforcement actions found for Śląski Uniwersytet Medyczny (Medical University of Silesia) in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
5 January 2021
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€5,500
Enforcement Tracker ID
ETid-527
About this data
Cite as: Cookie Fines. Śląski Uniwersytet Medyczny (Medical University of Silesia) - Poland (2021). Retrieved from cookiefines.eu
Last updated: