Chief National Surveyor (Główny Geodeta Kraju) – €13,800 Fine (Poland, 2022)

The Chief National Surveyor (the controller) accidentally disclosed land and mortgage register numbers on its website. The numbers were publicly available for about 48 hours. The controller did not notify the DPA and the affected data subjects of this event. In the investigation that followed, the controller claimed first, that the data disclosed were not personal data. Second, it argued that their publication was lawful and therefore did not constitute a data breach. Lastly, the controller submitted that, in any case, this disclosure did not entail any risk to the rights and freedoms of natural persons due to the short-term nature of the disclosure and the availability of the data in other sources. For this reason, the controller deemed that there was no need to notify the DPA and the affected data subjects under Articles 33(1) and 34(1) GDPR. The Polish DPA held, first, that land and mortgage register numbers constitute personal data. The land and mortgage register of natural persons contains, among others, first names, surnames, parents' names, PESEL numbers (i.e. an eleven-digit numeric symbol, uniquely identifying a natural person, containing the date of birth, serial number, gender and a control number), and real estate addresses. The land and mortgage register numbers consequently enabled anyone to identify persons whose data were included in the land and mortgage register. Thus, land and mortgage register number is information allowing one to indirectly identify a natural person. Second, the Polish DPA held that the publication of the land and mortgage register numbers was not lawful. Whilst the Land and Mortgage Register Act provides for the land and mortgage register being public via a dedicated ICT system, it does not refer to disclosing such information on publicly available websites. Similarly, the Geodetic and Cartographic Act states that the relevant data could only be shared by the district governor upon request. Lastly, the Regulations of the Minister of Development, Labor and Technology, an executive act that the controller also referred to in its submissions, cannot take precedence over the Geodetic and Cartographic Act and hence provide for universal access to the data concerned. Consequently, the Polish DPA held that the accidental disclosure of land and mortgage register numbers on the controller’s website constituted a personal data breach within the meaning of Article 4(12) GDPR. Third, in considering the failure to notify the DPA of the data breach, the DPA found that the controller did not assess the risk to the rights and freedoms of natural persons based on objective criteria. The controller merely asserted that the land and mortgage register was public and the numbers were also available in other sources. The DPA noted that risk assessments should be made from the point of view of the data subject’s interest and not that of the controller. In addition, the DPA emphasized that the existence of private entities that run websites allowing access to the content of land and mortgage registers cannot serve as a justification for non-compliance with the law on the part of the controller. Considering the above and the fact that the controller did not demonstrate, in accordance with the accountability principle, that it was unlikely that this data breach could result in a risk to rights and freedoms of natural persons, the DPA held that the controller violated Article 33(1) GDPR by not notifying the DPA of the personal data breach. Lastly, the DPA pointed out that the disclosure of a person’s PESEL number, together with their name and surname, could lead to identity theft. For this reason, there was a possibility of significant negative consequences for a large number of data subjects, and the likelihood of such a risk materializing was not low. There were also no factors reducing the probability of such negative consequences on the data subjects. Consequently, the DPA held that the personal data breach in question may have resulted in a high risk to the rights and freedoms of data subjects and the controller violated Article 34(1) GDPR by not notifying the affected data subjects of the breach, not even through a public announcement. As a result, the DPA fined the controller PLN 60,000 (roughly € 12,773) and ordered the controller to communicate the personal data breach to the data subjects within 3 days from the date of notification of this decision.