University Hospital of the Medical University of Warsaw – €2,120 Fine (Poland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The University Hospital of the Medical University of Warsaw was fined for not reporting a data breach where a patient received another patient's personal information by mistake. This matters because it highlights the importance of promptly notifying both affected individuals and authorities about data breaches. Small businesses should ensure they have procedures in place to handle such incidents.
What happened
The hospital failed to inform a patient and the authorities about a data breach involving personal information being sent to the wrong person.
Who was affected
Patients at the University Hospital of the Medical University of Warsaw whose personal data was mishandled.
What the authority found
The Polish DPA found that the hospital did not fulfill its obligation to report the data breach to the affected patient and the DPA, violating GDPR rules.
Why this matters
This case underscores the need for organizations to have clear protocols for reporting data breaches to both individuals and authorities. It serves as a reminder that even small oversights in data handling can lead to fines and reputational damage.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 16 March 2026.
Processing notes: articles corrected, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Polish DPA has imposed a fine of EUR 2,120 on the University Hospital of the Medical University of Warsaw. The university hospital had suffered a data breach in which a patient had received a referral from a doctor that contained, among other things, personal data (name, address, etc.) of another patient. The DPA found that neither the doctor nor the hospital informed the patient or the DPA about the data breach.
Related Enforcement Actions (0)
No other enforcement actions found for University Hospital of the Medical University of Warsaw in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
6 July 2022
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€2,120
Enforcement Tracker ID
ETid-1317
About this data
Cite as: Cookie Fines. University Hospital of the Medical University of Warsaw - Poland (2022). Retrieved from cookiefines.eu
Last updated: