Centrum Medyczne Ujastek Sp. z o.o. – €273,000 Fine (Poland, 2024)

The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed for the unlawful installation of surveillance equipment in two neonatal rooms. These devices recorded images of newborns and their mothers during intimate acts such as breastfeeding or care without informing patients or staff, which constitutes a violation of data protection regulations. The second fine, of around EUR 110,000, was imposed due to the loss or theft of memory cards on which these recordings were stored. The cards were not encrypted and the devices were not configured in accordance with the required security standards. It was also found that the risk analysis of the center did not take into account the dangers that led to this incident. ---UPDATE--- Following an appeal by the controller, the Provincial Administrative Court in Warsaw upheld the imposed fine.