The Third Fine Issued by Poland SA for not Reporting the Personal Data Breach to the Polish General Surveyor Has Been Published

The fine imposed by Poland SA for failure to notify the General Surveyor of Poland of the personal data breach became final with the decision rendered on 6 June 2022.

At the beginning of April 2022, in the service provided by the General Surveyor of Poland, namely www.geoportal.gov.pl. , the land, and mortgage registration numbers were visible for more than 48 hours and the Polish Supervisory Authority (SA) learned of the personal data breach from the media. Therefore, Poland SA informed the Polish General Surveyor of its obligation to report breaches of personal data to the supervisory authority.

Since no personal data breach notification has been received from GGK yet, the supervisory authority has initiated administrative action, during this process, GGK claimed that the title deed and mortgage registration numbers did not constitute personal data. GGK argued that the title deed and mortgage registration numbers can also be seen in other services and that the appearance of the numbers on www.geoportal.gov.pl for a short time does not pose any risk to the rights and freedoms of natural persons. Poland SA also referred to the decision of the Voivodeship Administrative Court in Warsaw (ref. II Sa/Wa 2222/20).

The decision is briefly as follows;

• The Polish SA imposed an administrative fine, amounting to PLN 60,000. This is the third administrative fine imposed on GGK by the Polish SA since GDPR came into force.
• In making its decision on the administrative fine, DPA took into account, inter alia, that the personal data breach was, in its opinion, of high gravity and serious nature.
• The fact that SA learned of the personal data breach from the media was also important in determining the penalty.

You can reach further information here.  

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr