Sanction RGPD Polish National Personal Data Protection Office (UODO) — Unknown : 5 k€ (2024)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- Unknown
- Montant de l'amende
- 5 k€
- Date de la décision
- 20 novembre 2024
- Fondement juridique
- Art. 28 (3) c), f), Art. 32 (1), (2)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Polish DPA has imposed a fine of EUR 4,700 on a subcontractor that was contracted to redesign the website of another company. This fine is linked to ETid-2491. Due to an error by an employee of the subcontractor, customer data (including first name, last name, email address, address, and encrypted passwords) was accidentally published on the website during the redesign process. The incident affected approximately 20,000 data subjects. During its investigation, the DPA found that the subcontractor had failed to implement and verify appropriate technical and organizational measures to protect personal data, which could have prevented such an incident.