- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Bank Millennium S.A – €78,000 Fine (Poland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Bank Millennium S.A. was fined €78,000 for losing important customer documents that contained personal information. The bank failed to report this loss to the authorities or inform the affected customers. This case highlights the importance of promptly notifying users about data breaches.
What happened
Bank Millennium S.A. lost customer documents containing personal data and did not report the incident to the authorities.
Who was affected
Customers of Bank Millennium S.A. whose personal information was included in the lost documents.
What the authority found
The Polish DPA found that the bank did not properly notify the DPA or the affected customers about the data breach, violating GDPR requirements.
Why this matters
This ruling emphasizes that companies must take data breaches seriously and notify both authorities and affected individuals without delay. It serves as a reminder for businesses to have clear protocols for handling data breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 10 March 2026.
Processing notes: amount discrepancy, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Polish DPA (UODO) has imposed a fine of EUR 78,000 on Bank Millennium S.A.. The UODO had become aware of a data protection breach following a complaint against the bank. It turned out that correspondence sent by the bank through a courier service containing personal data such as first name, last name, PESEL number, home address, account numbers and identification numbers of customers, had been lost. In this regard, the UODO found that the bank had failed to report the incident to the DPA and provide adequate notice to the data subjects.
Related Enforcement Actions (0)
No other enforcement actions found for Bank Millennium S.A in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
14 October 2021
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€78,000
Enforcement Tracker ID
ETid-901
About this data
Cite as: Cookie Fines. Bank Millennium S.A - Poland (2021). Retrieved from cookiefines.eu
Last updated: