[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJy_y9VL604Cu7pBVt0B-f2JLIrVhE1aT3Yyo8oZ2_kU":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":116},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"a4a0adca-4860-400c-b434-d9824f7f1851","NSA - III OSK 2508\u002F25","nsa-iii-osk-2508-25-19fc74","Created page with \"{{COURTdecisionBOX |Jurisdiction=Poland |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=NSA |Court_Original_Name=Naczelny Sąd Administracyjny |Court_English_Name=Supreme Administrative Court |Court_With_Country=NSA (Poland) |Case_Number_Name=III OSK 2508\u002F25 |ECLI= |Original_Source_Name_1= Centralna Baza Orzeczeń Sądów Administracyjnych |Original_Source_Link_1=https:\u002F\u002Forzeczenia.nsa.gov.pl\u002Fdoc\u002FCAC7EF6BFE |Original_Source_Language_1=Polish |Origina...\" Show changes","Poland's Supreme Administrative Court has ruled that a city mayor unlawfully processed personal data by accessing a former employee's Facebook account. The mayor used private conversations from the account, accessed via the employee's work computer, to initiate disciplinary and criminal proceedings. The court affirmed that login credentials, profile information, and conversation content constitute personal data under GDPR.","Poland's Supreme Administrative Court rules mayor unlawfully processed personal data via Facebook.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=NSA_-_III_OSK_2508\u002F25&diff=51929&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-22T13:05:30+00:00","2026-06-22T14:00:12.286412+00:00",7,[17],{"name":18,"type":19},"Facebook","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":41,"vendors":115},[42,71,89],{"slug":43,"name":44,"problem":45,"products":46},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":72,"name":73,"problem":74,"products":75},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[76,84],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":85,"product_name":86,"url":87,"description":88},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":90,"name":91,"problem":92,"products":93},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[94,99,107],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":95,"product_name":96,"url":97,"description":98},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[],{"slug":117,"title":118,"body":119,"framework_refs":120,"framework_notes":132},"mayor-unlawfully-accessed-ex-employees-facebook-account-via-work-computer","Mayor Unlawfully Accessed Ex-Employee's Facebook Account via Work Computer","A Polish city mayor accessed a former employee's personal Facebook account through their work computer, using private messages as evidence in disciplinary and criminal proceedings. Poland's Supreme Administrative Court ruled this constituted unlawful processing of personal data under GDPR, as login credentials, profile data, and private conversations all qualify as personal data. This case highlights the critical risk of privileged individuals abusing access to organisational devices to harvest personal information. It underscores that authority over workplace equipment does not grant legal rights to access employees' personal accounts or communications, and that GDPR protections extend to data encountered incidentally on work systems.",[121,122,123,124,125,126,127,128,129,130,131],"GDPR Article 5 (Principles of lawful processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 9 (Processing of special categories of data)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 AU-2 (Audit Events)","CIS Control 4 (Controlled Use of Administrative Privileges)","CIS Control 14 (Controlled Access Based on Need to Know)","ISO\u002FIEC 27001:2022 A.5.15 (Access Control)","ISO\u002FIEC 27001:2022 A.6.4 (Disciplinary Process)","ITIL Service Transition – Change and Configuration Management",{}]