Sanction RGPD Polish National Personal Data Protection Office (UODO) — Santander Bank Polska S. A. : 117 k€ (2022)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- Santander Bank Polska S. A.
- Montant de l'amende
- 117 k€
- Date de la décision
- 19 janvier 2022
- Fondement juridique
- Art. 34 (1)
- Manquement
- Manquement à la notification de violation de données
Résumé des faits
The Polish DPA has fined Santander Bank Polska S.A. EUR 118,000 for failing to notify data subjects of a data breach. A former employee of the bank managed to gain unauthorized access to a database for electronic services. Among other things, this allowed numerous Santander customers' data to be accessed. Due to the high risk for the data of the data subjects, the bank would have been obliged to inform them of the data breach. However, the bank deliberately refrained from doing so and continued to state that it would not comply with this obligation in the future. The DPA noted that this constituted a major intrusion for the data subjects, as they did not have the opportunity to take appropriate steps to protect their rights.