Poczta Polska (Polish Post) – €224,969 Fine (Poland, 2026)

The case concerned Poczta Polska S.A., the Polish national postal operator (the controller). On 24 February 2023, the controller notified the Polish Data Protection Authority (UODO) of a personal data breach involving unauthorised access to a tax document . While examining the breach notification, the DPA identified that the controller’s Data Protection Officer (DPO) simultaneously held several senior management roles within the organisation. In particular, the DPO served as: i) Director of an organisational unit; ii) Proxy for Classified Information Protection; and iii) Proxy for the Information Security Management System. Under the controller’s internal Organisational Regulation, the Director of unit “V.” was responsible for organising and improving the information protection system, including the protection of personal data. In that role, the DPO directly supervised the Information Protection Department, which was responsible for monitoring compliance, managing risks, conducting audits, and issuing opinions on contracts relating to data protection. In addition, the DPO held a power of attorney granted by the Management Board to represent the controller before the DPA and administrative courts in data protection matters. The controller acknowledged that it had not documented any formal assessment of potential conflicts of interest arising from the combination of these roles. It argued that no conflict existed because the DPO reported directly to the Management Board and was supported by a dedicated team. The controller also had not established any rules to prioritise the DPO’s tasks in the event of conflicting duties. During the DPA’s investigation, in March 2025, the controller changed its organisational structure by dissolving unit “V.” and establishing an independent DPO function reporting directly to the Management Board. The Polish DPA held that the controller infringed Article 38(6) GDPR by appointing a DPO who simultaneously held senior management positions involving responsibility for determining the means of processing personal data. The DPA found that, as Director of unit “V.” and as proxy for information security, the DPO was responsible for designing, implementing, and supervising data protection and information security measures. As a result, the DPO was required to monitor compliance with decisions for which he was himself responsible, creating a structural conflict of interest. The DPA rejected the controller’s argument that direct reporting to the Management Board and support from staff eliminated the conflict. It emphasised that the controller had neither documented an assessment of conflicts of interest nor established safeguards to prevent such conflicts. The DPA imposed an administrative fine of €232,000. It noted that the controller’s later organisational changes removed the conflict but did not eliminate liability for the earlier infringement.