Virgin Mobile Polska Sp. z o. o. – €452,761 Fine (Poland, 2022)

Virgin Mobile Polska S.A. (the controller) is a telecommunications services provider who offers pre-paid services to its subscribers. In December 2019, an unauthorised person gained access to 142,222 records with confirmations of registration for prepaid services. The data breach affected 114,963 persons whose first and last name, personal identification number, series and number of ID card, telephone number, and other personal data were accessed. The controller reported this data breach to the Polish DPA who initiated an investigation. During the course of the investigation, the DPA recevied oral explanations from the controller regarding the data breach as well as a detailed account of the incident. Reportedly, the controller adopted measures to rectify the deficiencies and vulnerabilities in its IT system. Based on the information provided by the controller, the DPA opened ex officio proceedings for the failure to implement appropriate technical and organisational measures ensuring an appropriate level of security. The DPA recalled that Article 24(1) GDPR sets out the basic obligation of the controller to comply with the principles under Article 5 GDPR, including the principle of confidentiality. Additionally, Article 32 GDPR obliges the controller to implement appropriate technical and organisational measures to ensure security of data processing. The DPA held that the controller failed to comply with the obligations under Article 32(1)(b) and (d) GDPR. Specifically, the data breach occurred as a result of the exploitation of a vulnerability in the IT system allowing unauthorised access to personal data. The DPA considered the measures adopted by the controller as not appropriate because their implementation should have included regular testing, measurement and assessment of effectiveness. The DPA also found a violation of Article 25(1) GDPR because the controller failed to implement obligations imposed by the Polish [https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20190000796 Anti-Terrorist Activities Act]. The DPA recalled that "data protection by design" refers to a variety of measures and necessary safeguards to protect the rights of data subjects, not only encryption and pseudonymisation. Moreover, the DPA stated that Article 5(2) GDPR requires controllers to demonstrate compliance with the data processing principles. The fact that the controller did not know whether or not the attacker may have had access nor the duration of the access, confirmed that the technical and organisational measures implemented by the controller were insufficient. The lack of knowledge of this information proved the lack of control over data processing. This in turn, constituted a breach of the principle of accountability under Article 5(2) GDPR. Taking into account the above-discussed findings, the DPA also held that the controller violated Article 24(1) GDPR by not fulfilling its responsibilities as a controller under the GDPR. Pursuant to Articles 58(2)(i) and 83 GDPR, the DPA imposed a PLN 1,968,524 fine on the controller for the above-discussed GDPR violations.