Sanction RGPD Polish National Personal Data Protection Office (UODO) — ID Finance Poland Sp. z o.o. : 235 k€ (2020)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- ID Finance Poland Sp. z o.o.
- Montant de l'amende
- 235 k€
- Date de la décision
- 17 décembre 2020
- Fondement juridique
- Art. 5 (1) f), Art. 25 (1), Art. 32 (1) b), d), (2)
- Manquement
- Mesures techniques et organisationnelles insuffisantes
Résumé des faits
The Polish DPA (UODO) imposed a fine of EUR 235,300 on ID Finance Poland Sp. z o.o. Due to an error while restarting a server, the settings of the software responsible for the server's security were reset, making the personal data of 140 699 customers publicly available. These data contained, for example, information about the first and last name, address, nationality or even marital status of the data subjects. The database located on this server was downloaded and deleted by an unspecified third party, who demanded a fee from the company for the return of the database. The DPA noted that the controller had taken insufficient technical and organizational measures to ensure the protection of the processing, even though there was a high risk for the data subjects due to the nature of the data processed.