Polish Bailiff Fined for DPO Conflict of Interest and Failure to Notify UODO

Written by AI from the linked story. Not reviewed by an editor. How this works

A court bailiff in Poland was fined PLN 15,500 for two distinct GDPR violations: failing to register the Data Protection Officer's contact details with the national supervisory authority, and allowing a single individual to simultaneously hold both the bailiff and DPO roles — a clear conflict of interest. GDPR Articles 37–39 mandate that the DPO must be able to perform their duties independently, which is structurally impossible when the DPO is also the controller or processor. This case highlights that GDPR compliance is not merely a technical exercise but requires proper organizational governance and role separation. Smaller organizations and sole practitioners are not exempt from these obligations and must proactively ensure both registration and independence requirements are met.

Tactical Insight

Immediate actions

Register the DPO's contact details with the relevant national Data Protection Authority as required under GDPR Article 37(7).
Conduct an immediate role-conflict audit to verify that the designated DPO holds no position that could create a conflict of interest with their oversight duties.

Organizational governance improvements

Establish a formal DPO independence policy that prohibits the DPO from simultaneously acting as a data controller, processor, or decision-making manager within the same organization.
For small organizations unable to staff an internal independent DPO, engage a qualified external DPO service provider to satisfy GDPR requirements.
Schedule annual GDPR compliance reviews to verify that DPO registrations remain current and that role assignments have not drifted into conflict.

Training & awareness measures

Provide targeted GDPR training for senior staff and officers on mandatory notification and role-separation obligations.
Include DPO conflict-of-interest scenarios in annual data protection awareness programmes to prevent inadvertent violations.