DPA case DKN.5131.24.2025 – Violation Found (Poland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bailiff was found to have violated data protection rules by not properly appointing a data protection officer. This matters because it highlights the importance of having clear roles in managing personal data.
What happened
The bailiff failed to publish the contact details of their data protection officer and had a conflict of interest.
Who was affected
Individuals whose data was handled by the bailiff's office.
What the authority found
The authority determined that the bailiff violated GDPR by not properly appointing a data protection officer and failing to communicate their details.
Why this matters
This case underscores the necessity for organizations to clearly define roles and responsibilities in data protection to avoid conflicts of interest.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A bailiff (the controller) appointed by a district court notified the DPA of a data breach in April 2023. According to the data breach notification, the controller also held the position of data protection officer within the bailiff's office from January 2020 to September 2025. However, the contact details of the data protection officer had not been published or communicated to the DPA. The DPA initiated an investigation regarding the appointment and the status of the data protection officer. The controller argued that it had not been obligated to appoint a data protection officer but had instead carried out the data protection officer's tasks on a voluntary basis. The DPA held that the controller had violated Articles 37(7) and 38(6) GDPR. It issued the controller a fine of PLN 3,500 (€800) for the former and PLN 12,000 (€2,700) for the latter GDPR infringement. The DPA imposed two separate fines on the controller as it considered the violations at issue to constitute two independent acts by the controller. First, the DPA concluded that the controller had failed to publish the contact details of the data protection officer and communicate them to the DPA as required by Article 37(7) GDPR. It pointed out that court bailiffs are public officials who execute judgments and perform their duties under the surveillance of a district court. In addition, they manage individual bailiff's offices. As controllers, bailiffs are obligated to appoint a data protection officer. Second, the DPA held that the controller's tasks and duties as both a bailiff and a data protection officer had resulted in a conflict of interests within the meaning of Article 38(6) GDPR. In the present case, the controller made decisions as a bailiff that must subsequently be subject to the data protection officer's assessment. This undermined the controller's ability to effectively carry out their tasks as a data protection officer. The controller had the highest-level position in the organisationa
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DKN.5131.24.2025 in PL
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DKN.5131.24.2025 - Poland (2026). Retrieved from cookiefines.eu
Last updated: