[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwMcr127gtY9DETtNV-NDSI_utnbt9M5Tg0MVQTk222U":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":76},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"d13cfdd4-b48a-4058-a0cd-f39ca46f0084","District Court Warsaw-Praga (Poland) - II C 1228\u002F19","district-court-warsaw-praga-poland-ii-c-1228-19-115943","← Older revision Revision as of 09:13, 24 June 2026 Line 10: Line 10: |ECLI= |ECLI= |Original_Source_Name_1= |Original_Source_Name_1=Oreczenia |Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001 |Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001 |Original_Source_Language_1=Polish |Original_Source_Language_1=Polish","The District Court in Warsaw-Praga awarded a data subject €212 for non-material damages resulting from a data breach by an electricity company. The breach occurred when an employee mistakenly emailed a file containing personal data of multiple clients, including names, addresses, and invoice numbers, to one customer. The court found the incident to be a 'personal data breach' under GDPR and awarded compensation based on Article 82 GDPR.","Polish court awards €212 in damages for GDPR data breach non-material harm.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=District_Court_Warsaw-Praga_(Poland)_-_II_C_1228\u002F19&diff=51981&oldid=30849","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-24T09:13:07+00:00","2026-06-24T10:00:13.856115+00:00",7,[17],{"name":18,"type":19},"GDPR","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":18,"slug":23},null,"gdpr",[25,30,32,37],{"category":26},{"id":27,"icon":22,"name":28,"slug":29},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":31},{"id":20,"icon":22,"name":18,"slug":23},{"category":33},{"id":34,"icon":22,"name":35,"slug":36},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":38},{"id":39,"icon":22,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":75},[46],{"slug":47,"name":48,"problem":49,"products":50},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":77,"title":78,"body":79,"framework_refs":80,"framework_notes":92},"employee-email-mistake-costs-electricity-company-212-in-gdpr-damages","Employee Email Mistake Costs Electricity Company €212 in GDPR Damages","An employee at a Polish electricity company accidentally sent a file containing multiple clients' personal data — including names, addresses, and invoice numbers — to the wrong recipient, constituting a personal data breach under GDPR Article 4(12). The root cause was a human error driven by insufficient security awareness training and a lack of technical controls to prevent misdirected emails containing sensitive data. The Warsaw-Praga District Court confirmed that even a single accidental disclosure of personal data to an unintended party qualifies as a compensable GDPR breach under Article 82, regardless of intent. This case underscores that non-material damages (stress, loss of privacy control) are recognized by courts, making even 'minor' data handling mistakes legally and financially consequential.",[81,82,83,84,85,86,87,88,89,90,91],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 82 – Right to compensation and liability","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 SC-28 – Protection of Information at Rest","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27001 Annex A 8.12 – Data Leakage Prevention","ISO\u002FIEC 27001 Annex A 6.3 – Information Security Awareness, Education and Training",{}]