Sanction RGPD Polish National Personal Data Protection Office (UODO) — Enea S.A. : 30 k€ (2021)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- Enea S.A.
- Montant de l'amende
- 30 k€
- Date de la décision
- 11 janvier 2021
- Fondement juridique
- Art. 33 (1)
- Manquement
- Manquement à la notification de violation de données
Résumé des faits
The Polish DPA (UODO) fined Enea S.A. EUR 30,000 for the controller's failure to report a personal data breach, in violation of Art. 33 (1) GDPR. The DPA received information about a personal data breach from a person who had become an unauthorized recipient of personal data. The breach consisted of sending an email with an unencrypted, non-password protected attachment that contained personal data of several hundred individuals. The sender of the email was an employee of the sanctioned controller.