Sanction RGPD Polish National Personal Data Protection Office (UODO) — McDonald’s Polska Sp. z o.o. : 4,0 M€ (2025)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- McDonald’s Polska Sp. z o.o.
- Montant de l'amende
- 4,0 M€
- Date de la décision
- 21 juillet 2025
- Fondement juridique
- Art. 5 (1) c), Art. 25 (1), Art. 28 (1), Art. 38 (1)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Polish DPA has imposed a fine of EUR 3,955,000 on McDonald’s Polska Sp. z o.o. The controller used a third party processor (see ETid: 2758) for the purpose of managing work scheduals. The controller failed to ensure, that the processor implemented sufficient technical and organisational measures to ensure data security, resulting in a data breach. Additionally the controller failed to ensure, that only necessary data had been processed and the controller also did not adequatly involve the DPO in all relevant activities.