[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdu5A53tquxtv4BmTv_D1ayZhBj5iKndQ9bgW_EizUqg":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"76df9230-7e90-4ea0-9216-2cfd1a138f4a","UODO (Poland) - DKN.5131.7.2022","uodo-poland-dkn-5131-7-2022-1fd9b1","Holding ← Older revision Revision as of 12:44, 26 June 2026 Line 83: Line 83: === Holding === === Holding === First, the DPA held that the controller had violated the principles of integrity and confidentiality enshrined in Article 5(1)(f) and the principle of accountability laid down in [[Article 5 GDPR#2|Article 5(2) GDPR]]. It had also violated Articles 24(1), 25(1), 28(1), 32(1) and 32(2) GDPR, which specify these principles. The DPA issued the controller a reprimand. First, the DPA held that the controller had violated the principles of integrity and confidentiality enshrined in Article 5(1)(f) and the principle of accountability laid down in [[Article 5 GDPR#2|Article 5(2) GDPR]]. It had also violated Articles [[Article 24 GDPR|24(1)]], [[Article 25 GDPR|25(1)]], [[Article 28 GDPR|28(1)]], [[Article 32 GDPR|32(1)]] and [[Article 32 GDPR|32(2)]] [[Article 32 GDPR|GDPR]], which specify these principles. The DPA issued the controller a reprimand. The DPA found the controller had failed to implement appropriate technical and organisational measures itself and also failed to properly verify whether the (sub-)processors had provided sufficient guarantees that they had implemented such measures. The data protection agreements required in [[Article 28 GDPR#1|Article 28(1) GDPR]] were very general in nature, and none of the parties in the chain of contracts had conducted a risk analysis to select appropriate security measures. In addition, the controller had not continuously monitored the processing activities. The DPA found the controller had failed to implement appropriate technical and organisational measures itself and also failed to properly verify whether the (sub-)processors had provided sufficient guarantees that they had implemented such measures. The data protection agreements required in [[Article 28 GDPR#1|Article 28(1) GDPR]] were very general in nature, and none of the parties in the chain of contracts had conducted a risk analysis to select appropriate security measures. In addition, the controller had not continuously monitored the processing activities. Second, the DPA held that the two processor and the sub-processor had violated Articles 32(1) and 32(2) GDPR read in conjunction with [[Article 28 GDPR#4|Article 28(4) GDPR]]. They had all failed to implement appropriate technical and organisational measures to ensure the security of personal data processing. The sub-processor was largely held responsible for the data breach – it had started using the app to process customers’ personal data without authorisation from the controller or the processors. Furthermore, the DPA pointed out the sub-processor should have verified whether the application would allow access to the personal data through it even after the termination of the employment relationship. The DPA reprimanded the processors and fined the sub-processor €2,415. Second, the DPA held that the two processor and the sub-processor had violated Articles [[Article 32 GDPR|32(1)]] and [[Article 32 GDPR|32(2) GDPR]] read in conjunction with [[Article 28 GDPR#4|Article 28(4) GDPR]]. They had all failed to implement appropriate technical and organisational measures to ensure the security of personal data processing. The sub-processor was largely held responsible for the data breach – it had started using the app to process customers’ personal data without authorisation from the controller or the processors. Furthermore, the DPA pointed out the sub-processor should have verified whether the application would allow access to the personal data through it even after the termination of the employment relationship. The DPA reprimanded the processors and fined the sub-processor €2,415. == Comment == == Comment ==","Poland's Data Protection Authority (UODO) has issued a reprimand to a data controller for violating GDPR principles of integrity, confidentiality, and accountability. The controller also failed to implement adequate technical and organizational measures and properly vet subprocessors. Additionally, two processors and a sub-processor were reprimanded for failing to implement appropriate security measures. The sub-processor was largely responsible for the data breach, having used an app to process personal data without authorization and failing to ensure continued access controls after employment termination. The sub-processor was fined €2,415.","Poland's UODO reprimands controller and processors, fines sub-processor €2,415 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.7.2022&diff=52004&oldid=52003","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-06-26T12:44:38+00:00","2026-06-26T14:00:33.36423+00:00",7,[17],{"name":18,"type":19},"UODO","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":77,"name":78,"problem":79,"products":80},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":106,"name":107,"problem":108,"products":109},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":154},"unauthorized-app-use-and-poor-subprocessor-oversight-lead-to-gdpr-breach-in-poland","Unauthorized App Use and Poor Subprocessor Oversight Lead to GDPR Breach in Poland","A data breach occurred because a sub-processor used an unauthorized application to process personal data and failed to revoke access controls after an employee's termination — two fundamental security failures. The root data controller compounded the risk by not properly vetting or monitoring its subprocessors, violating GDPR principles of integrity, confidentiality, and accountability. This case illustrates how third-party and supply chain relationships can become the weakest link in a data protection chain. Organizations cannot outsource accountability: they remain legally responsible for ensuring that every processor and sub-processor in the chain applies adequate technical and organizational safeguards.",[140,141,142,143,144,145,146,147,148,149,150,151,152,153],"GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 5(2) – Accountability Principle","GDPR Article 28 – Processor Obligations","GDPR Article 32 – Security of Processing","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 SA-9 – External Information System Services","NIST SP 800-53 PS-4 – Personnel Termination","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001 A.8.1 – Responsibility for Assets","ISO\u002FIEC 27001 A.9.2 – User Access Management","ISO\u002FIEC 27001 A.15.1 – Information Security in Supplier Relationships",{}]