Chief National Surveyor (Główny Geodeta Kraju) – €13,800 Fine (Poland, 2022)

The Chief National Surveyor (the controller) accidentally disclosed land and mortgage register numbers on its website. The numbers were publicly available for about 48 hours. The controller did not notify the DPA and the affected data subjects of this event. In the investigation that followed, the controller claimed first, that the data disclosed were not personal data. Second, it argued that their publication was lawful and therefore did not constitute a data breach. Lastly, the controller submitted that, in any case, this disclosure did not entail any risk to the rights and freedoms of natural persons due to the short-term nature of the disclosure and the availability of the data in other sources. For this reason, the controller deemed that there was no need to notify the DPA and the affected data subjects under Articles 33(1) and 34(1) GDPR. The Polish DPA held, first, that land and mortgage register numbers constitute personal data. The land and mortgage register of natural persons contains, among others, first names, surnames, parents' names, PESEL numbers (i.e. an eleven-digit numeric symbol, uniquely identifying a natural person, containing the date of birth, serial number, gender and a control number), and real estate addresses. The land and mortgage register numbers consequently enabled anyone to identify persons whose data were included in the land and mortgage register. Thus, land and mortgage register number is information allowing one to indirectly identify a natural person. Second, the Polish DPA held that the publication of the land and mortgage register numbers was not lawful. Whilst the Land and Mortgage Register Act provides for the land and mortgage register being public via a dedicated ICT system, it does not refer to disclosing such information on publicly available websites. Similarly, the Geodetic and Cartographic Act states that the relevant data could only be shared by the district governor upon request. Lastly, the Regulations of the