Prezes Urzędu Ochrony Danych Osobowych – Court Ruling (Poland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish court upheld a fine against the Warsaw University of Life Sciences for not protecting student data, which was exposed after a laptop theft. This case is important because it shows that organizations are responsible for data security, even if an employee makes a mistake.
What happened
The Warsaw University of Life Sciences failed to protect student data, leading to exposure after a laptop theft.
Who was affected
Over 80,000 study candidates whose personal data was stored on a stolen laptop.
What the authority found
The court ruled that the university was responsible for the data breach, as it determined the purposes and means of processing personal data.
Why this matters
This ruling emphasizes that organizations must implement strong data protection measures and are accountable for data breaches caused by employees. It serves as a reminder to review and enforce internal data security policies.
GDPR Articles Cited
On 20 August 2020, the Polish DPA [https://gdprhub.eu/index.php%3Ftitle=UODO_-_ZSO%C5%9AS.421.25.2019 imposed a fine] of approximately €11,000 on the Warsaw University of Life Sciences (SGGW) for failing to implement sufficient technical and organizational measures to prevent exposure of over 80000 records about study candidates. The data breach occurred as a result of a theft of a university employee's private laptop, on which the personal data of candidates for studies had been saved. The university argued that it had not been a controller of the data stored on the stolen device. Instead, it was the employee acting without knowledge of SGGW and in violation of internal procedures. The court fully upheld the DPA's decision and stated that the SGGW had violated the GDPR. The court disagreed with the argument that the SGGW had not been a data controller in the case. The university determined the purposes and means of the processing of personal data. Its employee was always acting on behalf of the university. Subsequently, the court agreed with the DPA that the university violated several provisions of the GDPR, including the principle of integrity and confidentiality and that the fine was correctly imposed.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Prezes Urzędu Ochrony Danych Osobowych in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Prezes Urzędu Ochrony Danych Osobowych - Poland (2021). Retrieved from cookiefines.eu
Last updated: