Municipality of Dobrzyniewo Duże – €1,700 Fine (Poland, 2022)

In February 2022, a security breach occured at the Municipality of Dobrzyniewo Duże (the controller). There was a break-in at an employee's flat and a laptop was stolen containing files with personal data of individuals (data subjects). As a consequence, the confidentiality of the personal data was compromised. The controller determined the scale of the resulting breach, which showed that the stolen computer contained 51 records with personal data in the following areas: name, address of residence or stay and PESEL (personal identification number). The Polish DPA initiated an ex officio investigation into the security breach as well as the controller's data processing practices. The DPA recalled the obligation of the controller to ensure confidentiality and integrity of personal data. Under the GDPR, the controller is obliged to ensure an adequate level of data protection through the implementation of appropriate technical and organisational measures, as well as measures aimed at the optimal configuration of the operating systems used by regularly testing, measuring and assessing the effectiveness of said measures in the form of security tests of the IT infrastructure. The DPA held that the controller did not take sufficient measures in order to prevent the security breach during the laptop theft, in breach of Article 32(1) GDPR. Moreover, the DPA found a violation of Articles 24(1) and 25(1) GDPR because the controller failed to apply technical measures ensuring a level of security corresponding to the risk of infringement of the rights or freedoms of natural persons by ensuring the ability to continuously monitor the confidentiality, integrity, availability and resilience of the processing systems and services. Since the confidentiality of the personal data in question was compromised as a result of the incident, the controller also violated Article 5(1)(f) GDPR. The consequence of a breach of the confidentiality principle by the controller was also a breach of