Virgin Mobile Polska Sp. z o. o. – €452,761 Fine (Poland, 2022)

Virgin Mobile Polska S.A. (the controller) is a telecommunications services provider who offers pre-paid services to its subscribers. In December 2019, an unauthorised person gained access to 142,222 records with confirmations of registration for prepaid services. The data breach affected 114,963 persons whose first and last name, personal identification number, series and number of ID card, telephone number, and other personal data were accessed. The controller reported this data breach to the Polish DPA who initiated an investigation. During the course of the investigation, the DPA recevied oral explanations from the controller regarding the data breach as well as a detailed account of the incident. Reportedly, the controller adopted measures to rectify the deficiencies and vulnerabilities in its IT system. Based on the information provided by the controller, the DPA opened ex officio proceedings for the failure to implement appropriate technical and organisational measures ensuring an appropriate level of security. The DPA recalled that Article 24(1) GDPR sets out the basic obligation of the controller to comply with the principles under Article 5 GDPR, including the principle of confidentiality. Additionally, Article 32 GDPR obliges the controller to implement appropriate technical and organisational measures to ensure security of data processing. The DPA held that the controller failed to comply with the obligations under Article 32(1)(b) and (d) GDPR. Specifically, the data breach occurred as a result of the exploitation of a vulnerability in the IT system allowing unauthorised access to personal data. The DPA considered the measures adopted by the controller as not appropriate because their implementation should have included regular testing, measurement and assessment of effectiveness. The DPA also found a violation of Article 25(1) GDPR because the controller failed to implement obligations imposed by the Polish [https://isap.sejm.gov.pl/isap.nsf/DocD