- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Urbis sp. z o.o. – Violation Found (Poland, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Urbis sp. z o.o. was found to have improperly disclosed personal data of people in quarantine. This is significant as it highlights the need for strict data protection during health crises.
What happened
The company accidentally revealed the addresses of individuals in quarantine due to a lack of supervision over sensitive information.
Who was affected
Individuals in quarantine had their personal addresses disclosed without authorization.
What the authority found
The Polish data protection authority found that Urbis failed to protect sensitive personal data, violating GDPR rules.
Why this matters
This finding underscores the importance of safeguarding personal data, especially during emergencies. Companies should strengthen their data protection protocols.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 23 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Polish DPA received a letter from the State District Sanitary Inspector in Gniezno informing about the public disclosure of the list containing the addresses of residence of the persons who are in quarantine, which was ordered by an administrative decision and the mandatory quarantine in connection with the crossing of the country border, as well as the address data of persons undergoing home isolation in connection with a confirmed infection of coronavirus SARS-CoV-2. In the course of the proceedings, Polish DPA established that unauthorized disclosure of data took place in a waste management company. An employee of the company, responsible for supervising the printed list of addresses of people in quarantine, left it for a short time without proper supervision. At that time, there was also another employee of the company in the room - a driver, who, taking advantage of the fact that the person responsible for supervising the printed list was directed back to him, copied (recorded as a photo) the list. The driver was to be informed by the person supervising the printed list whether, as part of his or her work, waste is to be collected from the places on the above mentioned list. The driver then made this photo available to at least one person. The Polish DPA took steps to clarify the situation. It called the controller to clarify whether, in determining the procedures related to the processing of personal data concerning the addresses of persons under quarantine in connection with the coronavirus threat, it has carried out an analysis of the method of distribution of the above mentioned data in electronic and paper versions in terms of threats related to the loss of their confidentiality and to inform what the result of this analysis was. In the submitted explanations, the company stated, that it carried out the analysis taking into account the circumstances related to the processors' failure to comply with the procedures in force in the company and the circumst
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for Urbis sp. z o.o. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
12 November 2020
Authority
Urząd Ochrony Danych Osobowych
About this data
Cite as: Cookie Fines. Urbis sp. z o.o. - Poland (2020). Retrieved from cookiefines.eu
Last updated: