DPA case DKN.5131.4.2024 – €263,555 Fine (Poland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A hospital in Poland reported a data breach involving stolen CCTV memory cards that held sensitive information. The Polish data protection authority found that the hospital did not have a valid reason for processing this personal data, which is important because it highlights the need for companies to have proper consent and legal grounds for handling personal information.
What happened
The hospital lost two CCTV memory cards containing personal data of 190 individuals.
Who was affected
Employees, patients, and guardians of patients at the hospital were affected by the breach.
What the authority found
The authority ruled that the hospital violated several GDPR articles by not having a valid legal basis for processing personal data.
Why this matters
This case emphasizes that organizations must ensure they have appropriate legal grounds for processing personal data. Companies should review their data handling practices to avoid similar violations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: articles corrected, national law identified, amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A hospital (a controller) notified the Polish DPA (UODO) about a data breach. The data breach amounted to loss or theft of two CCTV memory cards. The CCTV covered the area of two rooms located within the neonatal ward. The breach affected 190 individuals, including controller’s employees, patients and their guardians. Additionally, shortly after the breach notification, an article describing the controller unlawful processing of the CCTV data was published. The DPA decided to initiate ex officio proceedings against the controller. During the proceedings, the controller explained they used wall clocks, equipped with a CCTV to protect health and safety of newborns. The controller claimed there was an increased number of infections on the neonatal ward. Because preventive measures implemented prior to the CCTV were insufficient, the controller decided to rely on the CCTV. The personal data collected by the CCTV were processed under [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20111120654/U/D20110654Lj.pdf Article 23a(1)(2) of law on medical service activities] (ustawa o działalności leczniczej) and [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19740240141/U/D19740141Lj.pdf Article 22 note 1 of the labour code] (kodeks pracy) and Article 6(1)(f) GDPR too. The CCTV records were stored for no longer then 30 days. Moreover, the controller emphasised that QR codes with privacy notices and sticker informing about the CCTV were placed within their premises. Regarding the data breach, the controller clarified that stolen memory cards served as the only storage of the recordings and the controller didn’t possess any backups. After the breach, the controller organised few meetings with their employees and notified data subject about the breach. The DPA found the controller violated, Article 5(1)(a) GDPR, Article 5(2) GDPR, Article 6(1) GDPR, Article 9(1) GDPR, Article 13(1) GDPR and Article 13(2) GDPR. For the DPA there was no legal basis covering processing of
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DKN.5131.4.2024 in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 January 2025
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€263,555
1,145,891 PLN
GDPRhub ID
gdprhub-8893About this data
Cite as: Cookie Fines. DPA case DKN.5131.4.2024 - Poland (2025). Retrieved from cookiefines.eu
Last updated: