DPA case DKN.5130.2815.2020 – Violation Found (Poland, 2021)

The Company notified the Office for the Protection of Personal Data (UODO) of a breach in the protection of personal data of its employees, customers, and patients stored in an IT system. As a result, the Company was deprived of access to the aforementioned system and the personal data contained therein. The Company determined the scale of the breach, which showed that the encrypted databases contained approximately 80,000 employee, customer and patient data records concerning first and last names, parents' first names, date of birth, bank account number, address of residence, PESEL registration number, e-mail address, ID card series and number, telephone number and health data. The Company has not determined that there is a high risk of infringement of the rights or freedoms of natural persons due to the recovery of the encrypted data and has opted out of notifying data subjects of the breach. At the request of the authority, the company provided additional explanations, after which the DPA ex officio initiated administrative proceedings. The DPA found that the controller violated GDPR provisions because the technical measures implemented by the Company have not ensured an adequate level of security of the data processed through the IT systems, and issued a reprimand to the Company.