Sanction RGPD Polish National Personal Data Protection Office (UODO) — 24/7 Communication Sp. z o.o. : 43 k€ (2025)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- 24/7 Communication Sp. z o.o.
- Montant de l'amende
- 43 k€
- Date de la décision
- 21 juillet 2025
- Fondement juridique
- Art. 5 (1) c), Art. 25 (1), Art. 38 (1)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Polish DPA has imposed a fine of EUR 43,000 on 24/7 Communication Sp. z o.o. The fined entity acted as the data processor for McDonald’s Polska Sp. z o.o. (see ETid: 2757). The processor failed to implement sufficient technical and organisational measures to ensure data security, resulting in a data breach. The controller additionally infringed the principle of data minimisation and failed to adequately involve the DPO in relevant activities.