Unknown – €19,000 Fine (Poland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish hospital operator was fined EUR 19,000 after a former employee unlawfully copied patient data, including sensitive personal information. The hospital did not inform the affected patients about the breach despite the high risk to their data. This case stresses the importance of promptly notifying individuals when their data is compromised.
What happened
A former hospital employee unlawfully copied personal data of 100 patients, and the hospital failed to inform the patients about the breach.
Who was affected
Patients whose personal data, including social security numbers and contact details, were unlawfully accessed and copied.
What the authority found
The Polish data protection authority ruled that the hospital violated GDPR by not informing patients about the data breach.
Why this matters
This case serves as a warning to healthcare providers about the critical need to protect patient data and the legal obligation to notify individuals when their data is at risk. It highlights the importance of compliance with GDPR's breach notification requirements.
GDPR Articles Cited
The Polish DPA (UODO) imposed a fine of EUR 19,000 on a hospital operator. A former employee had unlawfully copied the personal data of 100 patients from the hospital's computer network. The leaked data included the social security number, name, date of birth, address and telephone number of the data subjects. Although the controller considered the potential risk to the data subjects to be high, she had not informed the data subjects about the incident. The DPA then requested the controller to immediately inform the data subjects about the incident and provide them with advice on how to minimize the potential negative impact of the breach. However, the controller did not comply with this request.
Related Enforcement Actions (8)
Other enforcement actions involving Unknown in PL
Fine
€19K
Details
Fine Date
5 January 2021
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€19,000
Enforcement Tracker ID
ETid-551
About this data
Cite as: Cookie Fines. Unknown - Poland (2021). Retrieved from cookiefines.eu
Last updated: