UODO (Poland) - DKN.5131.27.2023

A municipal social welfare unit in Poland was fined PLN 33,700 after an employee uploaded a file containing sensitive personal data — including quarantine status — to a private server, where it was subsequently indexed by public search engines. The root failures were threefold: inadequate technical and organisational controls to prevent unauthorised data sharing, a complete failure to report the breach to the supervisory authority (UODO), and a failure to notify the affected data subjects. This case illustrates that GDPR liability does not end with the breach itself — organisations that fail to follow mandatory notification obligations face compounded penalties. It also highlights how a single employee's insecure action, absent proper training and data handling controls, can expose an organisation to significant regulatory and reputational harm.