Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Poland: UODO fines company PLN 943,000 for GDPR violations

The Polish data protection authority ('UODO') announced, on 26 March 2019, that it had issued a fine of PLN 943,000 (approx. €220,000) against a company for its failure to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In particular, UODO highlighted that the company, acting as a data controller, failed to inform over six million data subjects that their personal data were being processed, which prevented them from exercising their rights under the GDPR.

UODO explained that the data controller obtained personal data of individuals from publicly accessible sources and processed such data for commercial purposes. Furthermore, the UODO highlighted that the data controller only fulfilled its information obligations under Article 14(1) to 14(3) of the GDPR in relation to those individuals whose email addresses it had obtained and failed to sufficiently inform the other individuals, as it claimed the costs would be high. In UODO's view, the data controller's violation was intentional, as it was aware of its information requirements, and failed to take measures to end the violation, or declare its intention to do so.

You can read the European Data Protection Board's press release here and UODO's press release, only available in Polish, here.

UPDATE (24 September 2023)

Supreme Court upholds UODO's decision to impose fine on Bisnode for failing to inform data subjects of data processing

The UODO announced, on 20 September 2023, that the Supreme Administrative Court upheld the UODO's decision to impose an administrative fine of PLN 943,000 (approx. €220,000) on Bisnode Polska (now Dun & Bradstreet), for processing data without informing the persons whose data is processed.

You can read the press release, only available in Polish, here.