Urbis sp. z o.o. – Violation Found (Poland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish waste management company mishandled a list of addresses of people in quarantine, leading to unauthorized data sharing. An employee took a photo of the list and shared it, breaching privacy rules. This incident underscores the importance of secure data handling procedures.
What happened
A waste management company employee improperly shared a list of addresses of people in quarantine.
Who was affected
Individuals in quarantine whose addresses were exposed by the waste management company.
What the authority found
The Polish data protection authority found that the company failed to secure personal data, leading to unauthorized disclosure.
Why this matters
This case emphasizes the need for strict data handling protocols, especially when dealing with sensitive information. Companies must ensure employees understand and follow data protection procedures.
GDPR Articles Cited
Polish DPA received a letter from the State District Sanitary Inspector in Gniezno informing about the public disclosure of the list containing the addresses of residence of the persons who are in quarantine, which was ordered by an administrative decision and the mandatory quarantine in connection with the crossing of the country border, as well as the address data of persons undergoing home isolation in connection with a confirmed infection of coronavirus SARS-CoV-2. In the course of the proceedings, Polish DPA established that unauthorized disclosure of data took place in a waste management company. An employee of the company, responsible for supervising the printed list of addresses of people in quarantine, left it for a short time without proper supervision. At that time, there was also another employee of the company in the room - a driver, who, taking advantage of the fact that the person responsible for supervising the printed list was directed back to him, copied (recorded as a photo) the list. The driver was to be informed by the person supervising the printed list whether, as part of his or her work, waste is to be collected from the places on the above mentioned list. The driver then made this photo available to at least one person. The Polish DPA took steps to clarify the situation. It called the controller to clarify whether, in determining the procedures related to the processing of personal data concerning the addresses of persons under quarantine in connection with the coronavirus threat, it has carried out an analysis of the method of distribution of the above mentioned data in electronic and paper versions in terms of threats related to the loss of their confidentiality and to inform what the result of this analysis was. In the submitted explanations, the company stated, that it carried out the analysis taking into account the circumstances related to the processors' failure to comply with the procedures in force in the company and the circumst
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Urbis sp. z o.o. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Urbis sp. z o.o. - Poland (2020). Retrieved from cookiefines.eu
Last updated: