SO Warszawa - III C 904/23
Polish court orders Financial Ombudsman to pay PLN 40,000 for data breach.
The Regional Court in Warsaw has ordered Poland's Financial Ombudsman to pay PLN 40,000 (approximately $10,000 USD) in non-material damages to a customer. The Ombudsman disclosed the customer's personal data to 28,366 unauthorized entities through a government platform due to an IT system failure. The court found the Ombudsman liable under Article 82 of the GDPR for failing to implement adequate security measures, leading to the data subject's non-material damages, including stress and loss of control over their data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Financial Ombudsman?
Get an email when a new story names Financial Ombudsman, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn IT system failure on a government platform caused Poland's Financial Ombudsman to inadvertently disclose one customer's personal data to 28,366 unauthorised recipients, resulting in a court-ordered PLN 40,000 GDPR damages award. The root cause was a failure to implement adequate technical and organisational security measures as required by GDPR Article 25 (data protection by design) and Article 32 (security of processing). This case illustrates that even unintentional data disclosures caused by technical misconfiguration carry significant legal and reputational consequences. It also highlights that non-material harm — such as stress and loss of control over personal data — is recognised as compensable damage under EU law, raising the stakes for any organisation handling personal data.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.