[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fllpqbosiJi62ZSOwHsAVVv4LzqkCSrYP8SYoYgaFtkU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"3964142a-3136-41e2-990c-3a4035b6ce1d","UODO (Poland) - DKN.5131.24.2025","uodo-poland-dkn-5131-24-2025-09f4cc","← Older revision Revision as of 13:16, 6 October 2026 Line 98: Line 98: First, the DPA concluded that the controller had failed to publish the contact details of the data protection officer and communicate them to the DPA as required by [[Article 37 GDPR|Article 37(7) GDPR]]. It pointed out that court bailiffs are public officials who execute judgments and perform their duties under the surveillance of a district court. In addition, they manage individual bailiff's offices. As controllers, bailiffs are obligated to appoint a data protection officer. First, the DPA concluded that the controller had failed to publish the contact details of the data protection officer and communicate them to the DPA as required by [[Article 37 GDPR|Article 37(7) GDPR]]. It pointed out that court bailiffs are public officials who execute judgments and perform their duties under the surveillance of a district court. In addition, they manage individual bailiff's offices. As controllers, bailiffs are obligated to appoint a data protection officer. Second, the DPA held that the controller's tasks and duties as both a bailiff and a data protection officer had resulted in a conflict of interests within the meaning of [[Article 38 GDPR|Article 38(6) GDPR]]. In the present case, the controller made decisions as a bailiff that must subsequently be subject to the data protection officer's assessment. This undermined the controller's ability to effectively carry out their tasks as a data protection officer. The controller had the highest-level position in the organisational hierarchy of the bailiff's office and therefore lacked an independent status within the organisation and the freedom to make autonomous decisions as a data protection officer. Second, the DPA held that the controller's tasks and duties as both a bailiff and a data protection officer had resulted in a conflict of interests within the meaning of [[Article 38 GDPR|Article 38(6) GDPR]]. In the present case, the controller made decisions as a bailiff that must subsequently be subject to the data protection officer's assessment. This undermined the controller's ability to effectively carry out their tasks as a data protection officer. The controller had the highest-level position in the organisational hierarchy of the bailiff's office and therefore lacked an independent status within the organisation as well as the freedom to make autonomous decisions as a data protection officer.","Poland's data protection authority (UODO) has fined a court bailiff PLN 15,500 (€3,500) for violating GDPR. The violations included failing to publish and communicate the data protection officer's contact details to the UODO, and a conflict of interest where the bailiff also served as the DPO, undermining their independence.","Poland's UODO fines court bailiff for GDPR violations regarding DPO.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.24.2025&diff=53303&oldid=53300","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-10-06T13:16:04+00:00","2026-10-06T14:00:22.945857+00:00",7,[17],{"name":18,"type":19},"UODO","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":62},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-missing-contact-details","Polish Bailiff Fined for DPO Conflict of Interest and Missing Contact Details","A court bailiff in Poland was fined €3,500 by UODO for two distinct GDPR violations: failing to publish and register the Data Protection Officer's contact details with the supervisory authority, and appointing themselves as their own DPO — a fundamental conflict of interest that undermines the independence the role requires. The DPO is designed to act as an independent overseer of data protection practices, and when the controller and DPO are the same person, that oversight becomes meaningless. This case highlights that GDPR compliance is not merely about technical safeguards but also about governance structures and administrative obligations. Even smaller organisations and individuals processing personal data professionally must meet these structural requirements or face regulatory sanctions.",[53,54,55,56,57,58,59,60,61],"GDPR Article 37 – Designation of the Data Protection Officer","GDPR Article 38 – Position of the Data Protection Officer (independence requirements)","GDPR Article 38(6) – Conflict of interest prohibition","GDPR Article 39 – Tasks of the Data Protection Officer","NIST SP 800-53 PM-2 (Senior Information Security Officer)","NIST SP 800-53 AC-5 (Separation of Duties)","CIS Control 17 – Implement a Security Awareness and Training Program","ISO\u002FIEC 27001:2022 – A.6.1.1 (Information security roles and responsibilities)","ITIL – Governance and Service Management (role clarity and accountability)",{}]