UODO (Poland) - DKN.5131.27.2023
Poland's UODO fines municipal welfare unit €7,800 for GDPR violations including data breach non-notification
Poland's Data Protection Authority (UODO) imposed three separate fines totaling PLN 33,700 (€7,800) on a municipal social welfare unit for multiple GDPR violations. The violations included failure to implement appropriate technical and organizational security measures and failure to notify a data breach involving health data and quarantine information that was inadvertently exposed via a public server and indexed by search engines in November 2020. The authority determined the unit acted as a data controller despite initial claims otherwise, and the breach went unreported despite being discovered in February 2021.
AI summary of the linked source. Not reviewed by an editor. How this works
Run UODO (Poland Data Protection Authority)?
Get an email when a new story names UODO (Poland Data Protection Authority), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA municipal social welfare unit in Poland failed to implement adequate technical and organizational measures to protect sensitive health and quarantine data, which was inadvertently exposed on a public server and indexed by search engines. Compounding the violation, the organization failed to report the breach to the supervisory authority within the mandatory 72-hour window after discovering it in February 2021 — more than two months after the November 2020 exposure. The case also highlights a governance failure, as the unit initially denied being the data controller, suggesting a lack of clarity around data ownership and accountability. These combined failures — poor security hygiene, delayed breach notification, and unclear data controller responsibilities — represent a systemic breakdown in GDPR compliance that resulted in three separate fines.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.