District Court Warsaw-Praga (Poland) - II C 1228/19

An employee at a Polish electricity company accidentally sent a file containing multiple clients' personal data — including names, addresses, and invoice numbers — to the wrong recipient, constituting a personal data breach under GDPR Article 4(12). The root cause was a human error driven by insufficient security awareness training and a lack of technical controls to prevent misdirected emails containing sensitive data. The Warsaw-Praga District Court confirmed that even a single accidental disclosure of personal data to an unintended party qualifies as a compensable GDPR breach under Article 82, regardless of intent. This case underscores that non-material damages (stress, loss of privacy control) are recognized by courts, making even 'minor' data handling mistakes legally and financially consequential.