Fortum Marketing and Sales Polska S.A. – €1,129,698 Fine (Poland, 2022)

The controller, Fortum Marketing and Sales Polska S.A. ("Fortum"), trades in electricity and gas fuel, including the sale of electricity and gas to end customers, both in the business sector and to households. Within the scope of its business activity, Fortum cooperates with the processor PIKA Spółka z o.o. ("PIKA"). PIKA provides Fortum with archive services, including digital archives. The parties are bound by a Data Processing Entrustment Agreement from 2018 and a Storage (Document Archive) Agreement with associated services from 2016. Fortum notified the Polish DPA of a personal data protection breach. According to them, the data of 137,314 customers had been copied. The breach of confidentiality concerned a newly created database containing information on Fortum's customers as follows: name and surname, residential or residence address, PESEL number, type, series and number of an identity document, e-mail address, telephone number, number and address of access point and contract data (e.g. date and number of contract, type of fuel, meter number). Fortum did not notify the data subjects of a data breach because, in its assessment, there was no high risk of a breach of the rights or freedoms of natural persons. Fortum presented the analysis results that finally established the number of persons to be notified of a personal data breach due to a high risk of infringement of rights or freedoms of natural persons. The explanations indicated that the data of 120,428 persons had been exposed, of which 95,711 persons should have been notified of the breach. The remaining numbers were business customers and deceased persons. Findings made in the course of the proceedings indicated that PIKA, as a processor to which Fortum had entrusted the processing of personal data of the persons affected by the breach, was also involved in the data breach. PIKA explained that, in case of changes to the systems, the individual departments of its IT division are required to record any changes made to the systems in their internal project management support and control systems. However, when making changes to the system, actual personal data of the Controller's customers were used. The effectiveness of the security features applied was not verified before the changes to the system were submitted to Fortum to resolve the performance issue. The security functions were not tested during the works carried out. In 2020, the Polish DPA notified PIKA of its recognition as a party to the proceedings. The DPA imposed administratives fine of PLN 4,911,732 (roughly €1,000,000) on Fortum and of PLN 250,135 (roughly €53,000) on PIKA. The DPA noted that under EN ISO/IEC 27002:2017-06, it is recommended to avoid using personal or other sensitive data as test data. If personal data are used during testing, it is recommended to protect all sensitive details and context by deleting or modifying them. The standard mentioned above accepts that actual data may be used for testing purposes, but such data should be subject to special protection. First of all, when real data is used for testing purposes, the same access control procedures should be applied in the tested applications as those used in production systems. The DPA held that PIKA had acted contrary to the agreement on entrusting personal data processing, which required, among other things, to implement data pseudonymisation. In defining the security measures that it would apply to protect personal data, PIKA omitted, in particular, the obligation arising from the GDPR to take into account the state of technical knowledge when defining them. The DPA cited the legal doctrine indicating that the need to consider the state of the art may be understood as the need to apply measures that reflect current security standards. This requirement may be read as the need to apply solutions currently considered adequate while not applying outdated solutions commonly assessed as not ensuring security. The DPA emphasised that using a processor did not exempt Fortum from these obligations. As a controller, the obligations in this regard remained primarily with Fortum itself. When analysing the actions, or rather the lack of actions by Fortum in this respect, the DPA concluded that it was more important for the controller to increase the capacity of the system as soon as possible than to ensure an adequate level of security of personal data processed using this system. It should be emphasised that Fortum indicated in the course of the proceedings that in the past practice of the Processor introducing changes to Fortum's systems, such changes were introduced according to a pre-agreed work plan, tested by Fortum on a test environment and only then implemented in production. Consequently, in the opinion of the DPA, both Fortum and PIKA failed to implement appropriate technical and organisational measures to ensure the security of the processing of personal data located in the IT system subject to modification, which constitutes a breach of Article 32(1) GDPR and Article 32(2) GDPR. Both Fortum and PIKA failed to implement appropriate technical and organisational measures to ensure the security of the processing of personal data, which led to Fortum breaching their confidentiality in connection with the occurrence of a personal data breach, i.e. a breach of the principles of confidentiality and integrity referred to in Article 5(1)(f) GDPR. According to Article 28(1) GDPR, where the processing is to be carried out on behalf of the controller, the controller shall only use the services of such processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of the data subjects. In the case in question, Fortum indicated that it had not verified PIKA prior to entering the data processing outsourcing agreement. Fortum has been cooperating with PIKA for many years, and no security incidents have occurred so far. Additionally, as Fortum pointed out, PIKA is a market leader in terms of the services provided and represents a high standard of archiving and digitalisation. Given the above, Fortum considered it sufficient to sign an agreement on entrustment of personal data processing together with arrangements indicated in the appendix to the agreement. Before initiating the administrative proceedings in question, Fortum also did not exercise the right of control referred to in Article 28(3)(h) GDPR concerning PIKA's provision of the measures required under Article 32 GDPR. Only after a personal data security breach had been identified and the administrative proceedings in question had been initiated, Fortum send a Processor Questionnaire to PIKA as the first element of the processor verification process. The DPA pointed out that, since the processing was to be carried out on behalf of the controller, following the wording of Article 28(1) GDPR, the controller could only use the services of such processors that provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures. Long-term cooperation of the parties, not supported by periodic, systematic audits or inspections, does not guarantee that the processor will adequately perform the tasks required by law and arising from the concluded entrustment agreement. A positively assessed cooperation in the past may only be a starting point when verifying whether the processor provides sufficient guarantees to implement appropriate technical and organisational measures so that the processing fulfils the requirements of GDPR and protects the rights of the data subjects. Indeed, the requirement set out in Article 28(1) GDPR applies to any data controller that, in the course of its business, uses the resources or services of a processor when processing personal data. The mere signing of a personal data processing outsourcing agreement without an appropriate assessment of the processor cannot be considered the fulfilment of the obligation to carry out a verification procedure of the processor concerning its compliance with the requirements of GDPR. Long-term cooperation and use of the services of a given processor before 25 May 2018, i.e. before the application of GDPR, also does not exempt from the obligation to carry out such an assessment. According to the DPA, Fortum did not carry out such verification in the case at hand. It only contented itself with a positive assessment of the processor as a result of previous cooperation, during which, as it explained, there were no security incidents. However, the consequence of failing to carry out this assessment is that Fortum has breached the requirement set out in Article 28(1) GDPR. Given the above findings, the DPA concluded that in the case at hand, the conditions justified the imposition of administrative pecuniary penalties on both the controller and the processor.